CrowdStrike reported on October 29, 2026, that an adversary it tracks as VAPOR PANDA used the ARTEX agent framework, primarily with DeepSeek and a second unidentified commercial large language model, to target more than 200 organizations. The company says it observed activity against entities in at least 14 countries over an 11-day window beginning October 17. CrowdStrike’s report describes one controller coordinating multiple engagements while a human operator directed the agents at decision points.
The 200-plus figure describes targeting, not 200 confirmed compromises. CrowdStrike says it confirmed post-exploitation activity at nine organizations and observed password-spraying or credential-scanning against at least 12 additional organizations.
The campaign’s scope, its attribution to the China-nexus VAPOR PANDA group, and the reconstruction of the operator’s actions are CrowdStrike’s threat-intelligence assessment. They have not been independently verified. On The Wire’s coverage also reported no identified response from DeepSeek or the Chinese government.
What CrowdStrike Observed
CrowdStrike says an ARTEX controller intermittently exposed tooling, target files and agent transcripts. Its intelligence team linked that controller to VAPOR PANDA infrastructure, while Falcon endpoint telemetry supplied additional evidence about malware deployment and follow-on activity.
Those evidence categories support different conclusions. A target file can indicate an intended victim; a transcript can reveal attempted actions; endpoint telemetry can show what happened inside a monitored environment. Treating them as interchangeable would overstate the reported outcome.
| Reported measure | CrowdStrike’s finding | How to interpret it |
|---|---|---|
| Organizations targeted | More than 200 | Campaign scope, not a confirmed breach count |
| Geographic reach | At least 14 countries | Activity observed during an 11-day window |
| Confirmed post-exploitation | Nine organizations | Evidence of access and subsequent malicious activity |
| Additional credential attacks | At least 12 organizations | Password-spraying or credential-scanning activity, without confirmed post-exploitation in that count |
The target list covered foreign ministries, telecommunications providers, think tanks and companies in sectors including pharmaceuticals, semiconductors, defense, nuclear technology and finance. CrowdStrike describes extensive intrusions at two Latin American foreign ministries, a likely compromise at a third, and a compromise at a Middle Eastern interior ministry.
A separate engagement targeted 19 US organizations. CrowdStrike also reports compromises at telecommunications providers in the United States, Belgium and the Philippines. Most organizations remain unnamed. The primary report distinguishes this campaign from ARTEX activity reported elsewhere under the Storm-0940 designation, so those actor labels should not be merged.
How ARTEX Coordinated the Intrusions
ARTEX supplied the coordination layer around the LLMs. According to CrowdStrike, a main agent worked with subordinate planner and worker agents, sharing a graph of accumulated facts, findings and goals. That shared state helped the system advance engagements through initial access, host reconnaissance and lateral movement.
The practical difference from a standalone chatbot is continuity. An agent framework can retain findings, assign work and feed results into subsequent actions. In CrowdStrike’s account, multiple engagements progressed in parallel, with the operator intervening to steer decisions.
Recovered transcripts reportedly contained Chinese-language instructions, marked as human instructions and timestamped in China Standard Time. The operator directed agents to write web shells, obtain domain administrator passwords and inventory endpoint security coverage. These traces describe human supervision; CrowdStrike’s actor attribution additionally relies on its infrastructure analysis.
My view is that parallel coordination is the consequential AI detail here. The individual techniques were familiar intrusion methods. The reported change was the ability to keep many engagements moving while a person supervised decision points. The published evidence does not quantify how much faster ARTEX made the operation compared with a human team.
Three Attack Chains Show the Work Assigned to Agents
CrowdStrike’s examples span web applications, cloud permissions, containers and enterprise identity systems:
- At one US pharmaceutical organization, an agent chained an unsigned Security Assertion Markup Language assertion with an XML external entity flaw. It queried the cloud Instance Metadata Service and obtained a role capable of issuing administration commands to thousands of instances, before escalating to recover an enterprise administrator account.
- At another US pharmaceutical organization, an agent deployed web shells, abused an unauthenticated orchestration service to gain root access in a production container environment, read Local Administrator Password Solution passwords, and abused resource-based constrained delegation to impersonate a privileged account.
- At a Greek government entity, the operator supplied a 2022 mail-server directory export containing authentication keys that CrowdStrike assessed had likely not been rotated. The agent used the keys to forge an administrator token and read mailboxes, then drew on VPN material found in email.
These examples point to a concrete defensive problem: agents can connect weaknesses across systems. An exposed service becomes more damaging when its privileges reach production containers or enterprise identity. A years-old export remains useful if the credentials inside it still work.
The Operator Explicitly Sought Hosts Without Falcon
At a pharmaceutical organization, the operator instructed the agents to identify Windows machines lacking CrowdStrike’s Falcon sensor. In CrowdStrike’s translation, the instruction was:
“find Windows machines in the domain without Falcon, judging by tasklist and folder listings”
SOCtember’s account of the report reproduces that instruction and explains that the operator used Chinese red-team slang for Falcon.
This is a specific sensor-avoidance step: the agents were asked to infer coverage from running processes and directory contents. It shows an operator deliberately directing activity toward visibility gaps. It does not demonstrate that Falcon, or another endpoint product, would have stopped every subsequent action.
For defenders, the practical implication reaches beyond one vendor. Endpoint deployment completeness is part of intrusion containment. A server missing from the security console can become a useful destination after an attacker obtains credentials elsewhere.
I’d prioritize reconciling the asset inventory with actual sensor health and reporting status. A deployment record is weaker evidence than a current check that the expected machine is reporting and protected.
What 1.4 Billion Input Tokens Tells Us
CrowdStrike says planning agents consumed approximately 1.4 billion input tokens in a single intrusion. That is a model-workload figure, not a count of successful actions, stolen records or unique pieces of information.
Input tokens measure material supplied to a model. Agent workflows can repeatedly submit instructions, previous findings and accumulated context, so token volume alone cannot reveal how much distinct information the system processed.
The figure also does not support a reliable campaign-cost estimate. CrowdStrike supplies neither an aggregate token count nor enough information about model versions, pricing, caching or deployment arrangements. Multiplying one intrusion’s consumption by the total target count would assume every engagement had the same workload, which the report does not show.
CrowdStrike identifies DeepSeek as the primary LLM and says a second subscription-based commercial LLM supplemented it, but could not identify that provider. The published account also leaves the DeepSeek access method unresolved: a hosted API, third-party service and self-deployed model would create different opportunities for provider monitoring and intervention. highlights this gap.
Frequently Asked Questions
3 questions
1Were More Than 200 Organizations Compromised?
CrowdStrike reported more than 200 targeted organizations. It confirmed post-exploitation at nine and observed credential attacks against at least 12 additional organizations.
