CrowdStrike: China-linked hackers ran AI agents against 200 organizations in 11 days

Summary

• CrowdStrike says VAPOR PANDA used an AI agent framework, ARTEX, against 200-plus organizations in 14 countries.
• A Middle East interior ministry and two Latin American foreign ministries were among the confirmed intrusions.
• One human operator directed simultaneous breaches, a scale shift defenders can now hunt with published indicators.

The latest

A China-linked espionage group ran AI agents against more than 200 organizations across at least 14 countries in an 11-day window starting 17 October 2026, CrowdStrike said in a report published 29 October. The firm's Counter Adversary Operations team attributed the campaign to VAPOR PANDA and said it is the first observed use of AI-driven intrusion tooling by that adversary.

Details

• The framework: CrowdStrike identified the tooling as ARTEX, an agentic framework in which a main agent coordinates subordinate planning and execution agents sharing a graph of facts, findings and objectives. The firm said this activity is distinct from ARTEX use Microsoft reported under the name Storm-0940.
• The scale: Nine organizations showed confirmed post-compromise activity including deployment of the BLOODALCHEMY backdoor, password spraying, network scanning and reconnaissance, according to the report. At least 12 more faced password spraying or credential scanning. In one intrusion, planning agents consumed roughly 1.4 billion input tokens.
• Government targets: CrowdStrike reported extensive intrusions at foreign ministries in two Latin American countries, a likely intrusion at a third, and a compromised interior ministry in the Middle East. Prepared target files covered Central America and Asia, with foreign ministries in Europe, Asia and the Middle East on the wider list.
• One European operation: A single operation targeted a European country's foreign ministry, presidency, prime minister's office, and its defense, justice, finance and intelligence bodies, according to the report. Telecommunications providers in the United States, Belgium and the Philippines were breached, along with a Greek government entity.
• US sectors hit: Another operation targeted 19 American organizations across pharmaceuticals, semiconductors, defense, nuclear and finance, CrowdStrike said. VAPOR PANDA has operated since 2021 against governments, research centers and energy and mining firms in Europe, North America, Oceania and Britain, seeking long-term access.
• The models: DeepSeek served as the primary model, supplemented by a commercial subscription-based large language model CrowdStrike was unable to identify. The firm assesses the multi-vendor setup most likely reflects a deliberate toolchain choice rather than improvisation.
• Human in the loop: Recovered scripts carried Chinese-language instructions tagged as human-written and timestamped to China time, steering agents at decision points, according to CrowdStrike. They covered writing web shells, extracting domain administrator passwords and inventorying machines protected by security sensors.
• Evading defenses: Agents were directed to locate Windows machines lacking the Falcon sensor so follow-on activity could concentrate on unprotected systems, the report said. They pursued parallel attack paths through web applications, cloud, containers, Active Directory, mail systems and VPNs, switching technique when a path failed.
• The backdoor: BLOODALCHEMY, first publicly documented in October 2023, uses a legitimate GameHook binary renamed svchost.exe to side-load a malicious DLL that decrypts an encrypted payload. CrowdStrike published three command-and-control domains, three IP addresses and three file hashes as indicators.
• The guidance: CrowdStrike advised rotating signing keys, pre-authentication keys and service credentials after any suspected exposure, including keys in old backups; enforcing SAML signature validation and IMDSv2; and hunting ARTEX markers such as command strings containing artx or artex, cloud roles beginning with artx, and the folder C:\ProgramData\artx5v\.

Background

VAPOR PANDA has run espionage operations since 2021 aimed at persistent access rather than immediate theft. CrowdStrike's OverWatch service detected this campaign, and Falcon telemetry surfaced details absent from prior public reporting, including the BLOODALCHEMY backdoor and its control infrastructure.

Between the lines

CrowdStrike frames the campaign as an escalation from isolated AI-assisted intrusions to simultaneous multi-target operations run by a single human operator. The 1.4 billion tokens in one intrusion and the Chinese-language decision-point instructions point the same way: ARTEX widened the reach of an existing mission rather than replacing it. The firm assesses it is highly likely China-linked actors will adopt similar agent frameworks over the next 12 months.

What's next

Watch for additional victim disclosures among the 200-plus organizations, confirmation of the unidentified commercial model, and whether security teams hunting the published artx indicators surface intrusions outside CrowdStrike's 11-day window.

Source: CrowdStrike