CrowdStrike says a China-linked group used AI agents to pursue more than 200 organizations in at least 14 countries, coordinating simultaneous intrusions through the open-source ARTEX penetration-testing framework.
In its October 29, 2026 report, CrowdStrike attributed the campaign to a group it tracks as VAPOR PANDA. The company says activity began on October 17 and was observed over an 11-day window. Targets included foreign ministries, telecommunications providers, and U.S. organizations in the pharmaceutical, semiconductor, defense, nuclear, and financial sectors.
The strongest distinction in the report is between the campaign’s reach and its confirmed outcomes. CrowdStrike identified post-exploitation activity at nine organizations. More than 200 organizations were targeted, but that figure is not a count of confirmed breaches.
The attribution, targeting totals, and compromise assessments come from CrowdStrike’s telemetry and analysis. They have not been independently verified in the reviewed sources.
What the Victim Counts Actually Show
CrowdStrike says a single ARTEX controller intermittently exposed tooling, target files, and agent transcripts. Those materials, together with Falcon telemetry, gave its researchers visibility into multiple engagements.
The campaign reached politically and economically sensitive targets. CrowdStrike describes extensive intrusions at two Latin American foreign ministries, a likely compromise at a third, and a compromised Middle Eastern interior ministry. Another engagement targeted a European country’s foreign ministry, presidency, prime minister’s office, and several other government bodies. Telecommunications providers in the United States, Belgium, and the Philippines were also compromised, according to the vendor.
The published numbers describe different levels of evidence:
| Reported figure | What it represents |
|---|---|
| More than 200 organizations | Organizations targeted using ARTEX |
| At least 14 countries | Geographic scope of the observed activity |
| Nine organizations | Confirmed post-exploitation activity |
| At least 12 additional organizations | Password-spraying or credential-scanning activity |
| About 70% of targets | A broader, later estimate combining confirmed compromises and evidence suggesting an intrusion with moderate confidence |
The first four figures appear in CrowdStrike’s primary report. The 70% estimate comes from information CrowdStrike subsequently gave CyberScoop for its October 30 coverage, which reported roughly 140 compromised targets.
Those accounts use different evidentiary thresholds. Nine is the explicit confirmed post-exploitation count in the primary report; the broader estimate includes cases assessed with moderate confidence. The public materials do not provide enough case-level detail to reconcile them fully.
For incident-response planning, I’d keep those categories separate. A scan, a suspected intrusion, and confirmed activity inside a network each demand attention, but they imply different containment work. Combining them into one breach count obscures what investigators actually observed.
How ARTEX Kept Humans in the Loop
CrowdStrike says ARTEX primarily used DeepSeek, supplemented by a second, subscription-based commercial LLM that its researchers could not identify.
The framework coordinated a main agent with subordinate planner and worker agents. They shared a graph containing facts, findings, and goals, allowing information gathered during reconnaissance to inform subsequent actions.
That shared state matters. An agent discovering an account, host, or access path can make the finding available to other agents pursuing the same engagement. A human operator can then steer several workflows without manually issuing every intermediate command.
Recovered transcripts showed that operators remained involved. CrowdStrike describes Chinese-language messages labeled 【人类指令】, translated as “human instruction,” with timestamps in China Standard Time. Instructions included writing web shells, extracting domain administrator passwords, and inventorying endpoint-sensor coverage.
The language and timestamps are operational clues, not sufficient evidence of state affiliation by themselves. CrowdStrike also says it linked the exposed controller to VAPOR PANDA infrastructure.
The reported workflow therefore supports a narrower and more useful description than an entirely autonomous hacking system: agents handled substantial portions of the work while an operator supplied direction and intervened at decision points.
CrowdStrike reports that planning agents consumed approximately 1.4 billion input tokens in one intrusion. Input tokens measure material supplied to a model, including context; they are not a count of commands, discoveries, or successful attacks. Repeatedly supplying existing context can contribute to that total. The figure indicates substantial model activity in that engagement, but cannot establish the campaign’s total consumption or cost.
Three Intrusion Chains Behind the Scale
CrowdStrike’s report provides three detailed examples of how ARTEX-assisted activity progressed inside targeted organizations. They show familiar weaknesses being chained together through automated workflows.
Identity and Metadata Access at a Pharmaceutical Company
At one U.S. pharmaceutical organization, CrowdStrike says an agent combined an unsigned Security Assertion Markup Language assertion with an XML external entity flaw to query a cloud Instance Metadata Service.
SAML assertions carry identity claims between systems. XML external entity flaws can allow an application’s XML processing to access resources available to the server. In this case, CrowdStrike says the chain produced access to a cloud role capable of issuing administrative commands to thousands of instances.
Image: VAPOR PANDA Uses AI-Driven ARTEX to Grow Global Espionage Campaign.
The report then describes escalation to recover an enterprise administrator account. The distinction is important: possessing a role with authority over thousands of instances is not evidence that commands were executed on every instance.
The practical concern is the connection between application-level weaknesses, cloud privileges, and enterprise identity. Each successful step expanded what the next step could reach.
Container Access and Delegation Abuse at a Second Company
At another U.S. pharmaceutical organization, the agent deployed web shells and abused an unauthenticated orchestration service to obtain root access in a production container environment.
CrowdStrike says the activity also included reading Local Administrator Password Solution, or LAPS, passwords and abusing resource-based constrained delegation to impersonate a privileged account.
LAPS manages local administrator credentials. Resource-based constrained delegation governs certain service-impersonation permissions in Active Directory. These are administrative mechanisms that can become useful to an attacker who obtains excessive access; their appearance in the intrusion is not evidence of an inherent vulnerability in either feature.
Root access inside a container also needs to be scoped accurately. It establishes high privileges in that environment, but it does not automatically mean the attacker controls the underlying host.
Old Authentication Keys at a Greek Government Entity
In the third example, an operator supplied the agent with a 2022 directory export from a Greek government entity’s mail server. CrowdStrike assessed that authentication keys in the export had likely not been rotated since then.
The agent used the keys to forge an administrator token and read mailboxes, according to the report.
This case makes the human contribution especially clear: the operator supplied historical material, and the agent used it in the current engagement. The consequential weakness was the apparent continued validity of old authentication material.
All three examples come from CrowdStrike’s published account. They provide technical detail for selected engagements, not a complete public reconstruction of all nine confirmed post-exploitation cases.
The Speed Claims Need Their Units
Frequently Asked Questions
3 questions
1Were All 200 Organizations Compromised?
No. CrowdStrike reported more than 200 targets and nine confirmed post-exploitation cases. A broader estimate given to CyberScoop included both confirmed and moderate-confidence intrusions.
