Eleven days, more than 200 organisations
CrowdStrike published research on 29 October describing a campaign in which a China-nexus intrusion group it tracks as VAPOR PANDA used an agentic AI framework to run intrusions against more than 200 distinct organisations at the same time. The activity began on 17 October 2026, and CrowdStrike says exploitation was directed at entities in at least 14 countries over an 11-day window.
The framework, which CrowdStrike calls ARTEX, puts a main agent in charge of subordinate planner and worker agents that share a graph of facts, findings and goals. It carries each engagement through initial access, host reconnaissance and lateral movement. CrowdStrike says ARTEX ran primarily on a Chinese-origin DeepSeek model, alongside a second subscription-based commercial model that its intelligence team could not confirm.
A person still steered it
This was not an unattended system. CrowdStrike reports that a human operator stayed in the loop, issuing instructions in Chinese and steering the agents at decision points, while the agents carried out the work between those points. The company describes the shift as moving “from single intrusions to multiple simultaneous engagements directed by a human operator” — the change is in how many targets one operator can hold at once.
The scale carries a measurable cost. CrowdStrike says the planning agents in one intrusion alone consumed on the order of 1.4 billion input tokens, and infers that consumption across the whole operation was far higher. That figure is one of the few published numbers that puts a price on running an intrusion this way.
The instruction about the sensor
The most pointed detail in the report is an instruction the operator gave the agents. In CrowdStrike’s English translation of the Chinese-language original, it reads: “find Windows machines in the domain without Falcon, judging by tasklist and folder listings.” Falcon is CrowdStrike’s own endpoint sensor, and the company says the check lets the adversary concentrate follow-on activity on hosts that are not monitored.
That is an old tradecraft idea — map the defender’s coverage first — handed to something that can run it across hundreds of networks in parallel.
What the agents actually reached
CrowdStrike confirmed post-exploitation activity at nine organisations, where the group deployed a backdoor it tracks as BLOODALCHEMY and carried out credential spraying, network scanning and reconnaissance. Password-spraying and credential-scanning activity reached at least 12 further organisations. One engagement was directed at 19 US-based organisations across several sectors.
The target list spans foreign ministries in Latin America, Europe, Asia and the Middle East, semiconductor, defence and think tank organisations in the United States, and telecommunications providers. CrowdStrike says this broadened the group’s usual targeting into pharmaceutical, semiconductor, nuclear and defence sectors, and into foreign ministries in regions it had not previously hit.
Where this sits
VAPOR PANDA has operated since 2021, mainly against government, think tank, energy and extractive organisations in Europe, North America, Oceania and the United Kingdom, with the aim of holding long-term access. CrowdStrike assesses this campaign as an expansion of that existing access-development mission rather than a change of purpose. What is new is the tooling: the company says this is the first time it has observed the group using AI-driven intrusion tooling.
What to watch
CrowdStrike says it expects China-nexus adversaries to keep adopting agentic frameworks like ARTEX over the next 12 months. For defenders, the concrete item from this report is the sensor-coverage check: the campaign treated unmonitored hosts as the point of entry, and an inventory gap is now something an agent can be told to look for at scale.
