CrowdStrike says a China-linked espionage group it tracks as VAPOR PANDA used an agentic artificial intelligence framework to run intrusions against more than 200 organizations at the same time, in what it calls an escalation from AI-assisted single break-ins to running many in parallel under one human operator.
In a report published this week, CrowdStrike's OverWatch team said the campaign began on October 17, 2026, and that exploitation activity from a single ARTEX controller reached entities in at least 14 countries over an 11-day window. Targets included foreign ministries in Latin America, Europe, Asia and the Middle East, along with pharmaceutical, semiconductor, defense, nuclear and financial organizations in the United States and telecommunications providers in the United States, Belgium and the Philippines.
The numbers need careful reading. CrowdStrike confirmed post-exploitation activity at nine organizations, where the attackers gained access, deployed the BLOODALCHEMY backdoor and followed up with credential spraying, network scanning and reconnaissance. At least 12 more organizations faced password spraying or credential scanning, including United States think tanks and European government entities. Being targeted is not the same as being breached, and CrowdStrike did not say all 200-plus organizations were compromised.
ARTEX coordinates a main agent with planner and worker agents that share a graph of facts, findings and goals, moving each engagement from initial access through reconnaissance and lateral movement. CrowdStrike said VAPOR PANDA ran it mainly on DeepSeek, the Chinese-developed large language model, supplemented by a second, subscription-based commercial model the company could not identify. In a single intrusion, the planning agents consumed on the order of 1.4 billion input tokens, a figure CrowdStrike offered as a measure of how much automated work the framework was doing.
A human stayed in charge. Recovered transcripts showed an operator issuing instructions in Chinese, timestamped in China Standard Time, and stepping in at decision points to direct the agents to write web shells, extract domain administrator passwords and inventory endpoint sensor coverage. In one case the operator told the agents to find Windows machines in a domain without the CrowdStrike Falcon sensor installed, so follow-on activity could concentrate on unprotected hosts — sensor evasion built directly into the workflow, rather than added afterward.
The tradecraft underneath the automation was familiar. At one United States pharmaceutical organization, an agent chained an unsigned SAML assertion and an XML external entity flaw to reach the cloud instance metadata service and obtain a role able to issue administration commands to thousands of instances. At another, agents deployed web shells, abused an unauthenticated orchestration service for root access in a production container environment and read Local Administrator Password Solution passwords. Against a Greek government entity, the agents used authentication keys from a 2022 mail server directory export that apparently had never been rotated.
CrowdStrike said this was VAPOR PANDA's first observed use of AI-driven intrusion tooling, broadening a group that since 2021 has mainly targeted government, think tank, energy and extractive organizations. It stressed that this campaign is separate from other ARTEX activity reported under the Storm-0940 designation, suggesting several China-linked actors are now adopting the same framework, and assessed that adoption is highly likely to continue over the next 12 months.
For defenders, CrowdStrike's advice is unglamorous and specific: rotate signing keys and service credentials after any suspected exposure, including keys in old backups; enforce SAML signature validation; require IMDSv2 and limit cloud roles' command permissions; patch internet-facing appliances; and run endpoint detection on servers even when they are considered unreachable from the internet. The fixes are old — it is the attacker's speed and scale that are new.