CrowdStrike says China-linked Vapor Panda ran the ARTEX AI tool against more than 200 organisations
See how this story connectsCrowdStrike says Vapor Panda, a China-nexus group it tracks, used the agentic attack framework ARTEX with the DeepSeek model and a second, subscription-based commercial model it could not identify to attack more than 200 organisations in at least 14 countries from 17 October 2026, over 11 days. Targets included foreign ministries in Latin America, Europe, Asia and the Middle East, a Middle East interior ministry, 19 US pharmaceutical, semiconductor, defence, nuclear and financial organisations, and telecoms providers in the US, Belgium and the Philippines. CrowdStrike confirmed post-exploitation at nine organisations, where the group deployed the BLOODALCHEMY backdoor. A human operator directed the agents in Chinese, including an instruction to find Windows machines without CrowdStrike’s Falcon sensor, and one intrusion used about 1.4 billion input tokens. CrowdStrike says the campaign is separate from the ARTEX activity Microsoft attributed to Storm-0940 and is the group’s first observed use of AI-driven intrusion tooling.
Why it matters
CrowdStrike says one operator ran several intrusions at once, stepping in only at decision points, and expects China-nexus groups to keep adopting frameworks such as ARTEX over the next 12 months.
- When
- 29 Oct 2026
- ID
WTA-N-2026-0558- Where
- China, International
- Who
- CrowdStrike, DeepSeek
- Topics
- Cybersecurity, AI incidents, Frontier models
- System
- ARTEX agentic attack framework with DeepSeek and a second commercial model
- Operator
- Vapor Panda, a China-nexus group (attribution by CrowdStrike)
- Type
- parallel intrusions against more than 200 organisations in at least 14 countries, post-exploitation confirmed at nine
- Status
- disclosed 29 Oct 2026; disclosed by CrowdStrike · Incident ledger
Summary written with AI by wheresthe.ai, from CrowdStrike and the reporting credited above. Checked against the source on 30 Oct 2026.
Source copy: saved on 30 Oct 2026 to check this story and not republished, because the text belongs to its publisher. Also held by the Internet Archive.
Cite this story
WTA-N-2026-0558: “CrowdStrike says China-linked Vapor Panda ran the ARTEX AI tool against more than 200 organisations.” wheresthe.ai, 29 Oct 2026. https://wheresthe.ai/d/cn-china-linked-hackers-used-ai-to-target-200-organisations-2026-10/ (source: CrowdStrike).
Spotted an error? Email [email protected].