CrowdStrike Says AI Agents Targeted 200+ Organizations

CrowdStrike says a China-linked group used AI agents to pursue more than 200 organizations in at least 14 countries, coordinating simultaneous intrusions through the open-source ARTEX penetration-testing framework.

In its October 29, 2026 report, CrowdStrike attributed the campaign to a group it tracks as VAPOR PANDA. The company says activity began on October 17 and was observed over an 11-day window. Targets included foreign ministries, telecommunications providers, and U.S. organizations in the pharmaceutical, semiconductor, defense, nuclear, and financial sectors.

The strongest distinction in the report is between the campaign’s reach and its confirmed outcomes. CrowdStrike identified post-exploitation activity at nine organizations. More than 200 organizations were targeted, but that figure is not a count of confirmed breaches.

The attribution, targeting totals, and compromise assessments come from CrowdStrike’s telemetry and analysis. They have not been independently verified in the reviewed sources.

What the Victim Counts Actually Show

CrowdStrike says a single ARTEX controller intermittently exposed tooling, target files, and agent transcripts. Those materials, together with Falcon telemetry, gave its researchers visibility into multiple engagements.

The campaign reached politically and economically sensitive targets. CrowdStrike describes extensive intrusions at two Latin American foreign ministries, a likely compromise at a third, and a compromised Middle Eastern interior ministry. Another engagement targeted a European country’s foreign ministry, presidency, prime minister’s office, and several other government bodies. Telecommunications providers in the United States, Belgium, and the Philippines were also compromised, according to the vendor.

The published numbers describe different levels of evidence:

The first four figures appear in CrowdStrike’s primary report. The 70% estimate comes from information CrowdStrike subsequently gave CyberScoop for its October 30 coverage, which reported roughly 140 compromised targets.

Those accounts use different evidentiary thresholds. Nine is the explicit confirmed post-exploitation count in the primary report; the broader estimate includes cases assessed with moderate confidence. The public materials do not provide enough case-level detail to reconcile them fully.

For incident-response planning, I’d keep those categories separate. A scan, a suspected intrusion, and confirmed activity inside a network each demand attention, but they imply different containment work. Combining them into one breach count obscures what investigators actually observed.

How ARTEX Kept Humans in the Loop

CrowdStrike says ARTEX primarily used DeepSeek, supplemented by a second, subscription-based commercial LLM that its researchers could not identify.

The framework coordinated a main agent with subordinate planner and worker agents. They shared a graph containing facts, findings, and goals, allowing information gathered during reconnaissance to inform subsequent actions.

That shared state matters. An agent discovering an account, host, or access path can make the finding available to other agents pursuing the same engagement. A human operator can then steer several workflows without manually issuing every intermediate command.

Recovered transcripts showed that operators remained involved. CrowdStrike describes Chinese-language messages labeled 【人类指令】, translated as “human instruction,” with timestamps in China Standard Time. Instructions included writing web shells, extracting domain administrator passwords, and inventorying endpoint-sensor coverage.

The language and timestamps are operational clues, not sufficient evidence of state affiliation by themselves. CrowdStrike also says it linked the exposed controller to VAPOR PANDA infrastructure.

The reported workflow therefore supports a narrower and more useful description than an entirely autonomous hacking system: agents handled substantial portions of the work while an operator supplied direction and intervened at decision points.

CrowdStrike reports that planning agents consumed approximately 1.4 billion input tokens in one intrusion. Input tokens measure material supplied to a model, including context; they are not a count of commands, discoveries, or successful attacks. Repeatedly supplying existing context can contribute to that total. The figure indicates substantial model activity in that engagement, but cannot establish the campaign’s total consumption or cost.

Three Intrusion Chains Behind the Scale

CrowdStrike’s report provides three detailed examples of how ARTEX-assisted activity progressed inside targeted organizations. They show familiar weaknesses being chained together through automated workflows.

Identity and Metadata Access at a Pharmaceutical Company

At one U.S. pharmaceutical organization, CrowdStrike says an agent combined an unsigned Security Assertion Markup Language assertion with an XML external entity flaw to query a cloud Instance Metadata Service.

SAML assertions carry identity claims between systems. XML external entity flaws can allow an application’s XML processing to access resources available to the server. In this case, CrowdStrike says the chain produced access to a cloud role capable of issuing administrative commands to thousands of instances.

Image: VAPOR PANDA Uses AI-Driven ARTEX to Grow Global Espionage Campaign.

The report then describes escalation to recover an enterprise administrator account. The distinction is important: possessing a role with authority over thousands of instances is not evidence that commands were executed on every instance.

The practical concern is the connection between application-level weaknesses, cloud privileges, and enterprise identity. Each successful step expanded what the next step could reach.

Container Access and Delegation Abuse at a Second Company

At another U.S. pharmaceutical organization, the agent deployed web shells and abused an unauthenticated orchestration service to obtain root access in a production container environment.

CrowdStrike says the activity also included reading Local Administrator Password Solution, or LAPS, passwords and abusing resource-based constrained delegation to impersonate a privileged account.

LAPS manages local administrator credentials. Resource-based constrained delegation governs certain service-impersonation permissions in Active Directory. These are administrative mechanisms that can become useful to an attacker who obtains excessive access; their appearance in the intrusion is not evidence of an inherent vulnerability in either feature.

Root access inside a container also needs to be scoped accurately. It establishes high privileges in that environment, but it does not automatically mean the attacker controls the underlying host.

Old Authentication Keys at a Greek Government Entity

In the third example, an operator supplied the agent with a 2022 directory export from a Greek government entity’s mail server. CrowdStrike assessed that authentication keys in the export had likely not been rotated since then.

The agent used the keys to forge an administrator token and read mailboxes, according to the report.

This case makes the human contribution especially clear: the operator supplied historical material, and the agent used it in the current engagement. The consequential weakness was the apparent continued validity of old authentication material.

All three examples come from CrowdStrike’s published account. They provide technical detail for selected engagements, not a complete public reconstruction of all nine confirmed post-exploitation cases.

The Speed Claims Need Their Units

CyberScoop reported additional figures from CrowdStrike, including requests occurring as often as every 10 seconds. Adam Meyers, CrowdStrike’s senior vice president of counter adversary operations, also compared historically tracked human-led activity of up to 40 commands per hour with ARTEX activity exceeding 1,500 commands per hour.

These are vendor observations reported through an interview, not a controlled performance benchmark. Requests and commands are also different units, so the figures should not be combined into one execution rate.

The defensible conclusion is that CrowdStrike observed much denser activity and parallel task execution. The numbers do not isolate how much improvement came from the LLM, the framework’s orchestration, the available credentials, or weaknesses in particular targets.

CrowdStrike also explicitly separates VAPOR PANDA’s operation from the ARTEX campaign Microsoft tracks as Storm-0940. In its October 21 report, Microsoft described ARTEX use beginning as early as September and some cases of privileged cloud access within three hours. That timing belongs to Microsoft’s separate investigation and should not be attached to VAPOR PANDA.

The shared framework is significant, but it does not make the two campaign histories interchangeable.

Where Defenders Can Interrupt the Workflow

The reported intrusion chains point to specific controls that remain useful regardless of which LLM an attacker selects.

Check endpoint coverage against the actual asset inventory. CrowdStrike says operators instructed agents to identify hosts without Falcon sensors. That makes coverage gaps an explicit input to the attacker’s planning. Defenders should investigate missing, inactive, or unhealthy sensors alongside other signs of compromise. The instruction demonstrates intent to find less-monitored systems; it does not prove every evasion attempt succeeded.

Investigate application access alongside cloud and identity activity. The first pharmaceutical example crossed an application boundary, a metadata service, cloud administration, and enterprise identity. A response confined to the initially affected application could miss credentials or privileges acquired later. Correlating those stages is more useful than treating each alert as an isolated event.

Restrict orchestration services and access to managed passwords. The second pharmaceutical example makes unauthenticated administrative services and excessive credential access concrete priorities. Review which identities can read LAPS passwords and alter delegation settings, especially after an attacker obtains access to a production environment.

Treat archived authentication material as a live risk. The Greek government example shows why old exports deserve attention during containment. Removing an exposed file does not invalidate the keys it contained. Responders need to determine whether those keys remain valid and rotate or revoke affected material where necessary.

Preserve evidence while containing access. CrowdStrike describes deployment of the BLOODALCHEMY backdoor and follow-on reconnaissance, scanning, and credential attacks. Finding one web shell should therefore trigger an investigation into persistence, stolen credentials, and subsequent activity, not simply deletion of that file.

My priority would be to shorten the gap between detecting an initial foothold and containing the identities and systems it can reach. That judgment follows from the documented chains: ARTEX’s advantage was its ability to keep pursuing connected opportunities, with human direction when needed. Faster alert generation alone leaves that opportunity intact if containment still waits on a slow, fragmented response.