VAPOR PANDA Ran ARTEX and DeepSeek Against 200+ Organizations: What CrowdStrike Confirmed

CrowdStrike OverWatch reported on October 29, 2026 that VAPOR PANDA, a China-based targeted intrusion actor CrowdStrike has tracked since 2021, used the open-source ARTEX agentic framework — powered mainly by DeepSeek plus a second unidentified subscription-based commercial LLM — against more than 200 organizations in at least 14 countries over an 11-day window starting October 17, 2026. Nine organizations were confirmed breached with the BLOODALCHEMY backdoor deployed, and at least 12 more were hit with password spraying and credential scanning but not counted as confirmed intrusions. CrowdStrike reported that planning agents consumed about 1.4 billion input tokens in a single intrusion, framing the campaign as a shift from AI assisting one intrusion to a single human operator running many in parallel.

CrowdStrike says a China-linked espionage group used an open-source AI agent framework, powered mostly by DeepSeek, to run intrusions against more than 200 organizations in 11 days. The number that matters for defenders is smaller: nine organizations were confirmed breached. The rest were targets, password-spraying victims or staged target files. The report, published by CrowdStrike OverWatch on October 29, 2026 and picked up by NBC News https://www.nbcnews.com/tech/security/china-linked-hackers-used-ai-target-200-organizations-crowdstrike-says-rcna606343?ref=explainx the same day, is the clearest public case so far of one human operator directing many simultaneous AI-driven engagements. The framework is ARTEX, which we first covered after the South Korean bank hacks https://explainx.ai/blog/south-korea-ai-bank-hacks-artex-credential-stuffing-october-2026 . This post separates what CrowdStrike's own write-up https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/?ref=explainx confirms from what the headlines compress. VAPOR PANDA and ARTEX at a glance TL;DR | Question | Answer | |---|---| | Who did it? | VAPOR PANDA, a China-based targeted intrusion actor CrowdStrike has tracked since 2021 | | What tool? | ARTEX, an open-source agentic framework with a main agent plus planner and worker agents | | Which models? | Mainly DeepSeek, plus a second subscription-based commercial LLM CrowdStrike could not identify | | When? | From October 17, 2026, observed over an 11-day window | | How wide? | More than 200 distinct organizations targeted, in at least 14 countries | | How many confirmed breaches? | Nine, with the BLOODALCHEMY backdoor deployed | | Other victims? | At least 12 more hit with password spraying and credential scanning, not counted as confirmed intrusions | | How big was the AI workload? | About 1.4 billion input tokens consumed by planning agents in a single intrusion | | Is it the South Korea case? | No, a separate campaign using the same framework | Agents that act on your behalf need rules. See how explainx helps secure your agents → https://explainx.ai/agentbeam?src=blog note What did CrowdStrike actually observe? CrowdStrike OverWatch watched exploitation activity from a single ARTEX controller starting October 17. The controller intermittently exposed adversary tooling, target files and agent transcripts, which is how CrowdStrike could see that multiple engagements, which ARTEX calls "tasks", were running against multiple targets at once. The reported targets were wide. VAPOR PANDA ran extensive intrusions at the foreign ministries of two Latin American countries, likely compromised a third, and staged target files for ministries in Central America and Asia. It compromised an interior ministry in the Middle East. One engagement went after a single European country's foreign ministry, presidency and prime minister's office, plus defense, justice, finance and intelligence entities. A separate one hit 19 US organizations across pharmaceutical, semiconductor, defense, nuclear and financial sectors, and telecom providers in the US, Belgium and the Philippines were compromised. CrowdStrike frames this as an escalation: from AI assisting a single intrusion to a human operator running many in parallel. That is the part worth remembering a month from now, whatever happens to the exact counts. Beads escaping a cracked vessel, a metaphor for VAPOR PANDA ARTEX breaches among 200 targets 200 targeted, nine confirmed: reading the numbers Most headlines lead with 200. The CrowdStrike text is more careful, and the gap is the story's main caveat. | Number | What it counts | Source | |---|---|---| | 200+ | Distinct organizations the adversary used ARTEX against | CrowdStrike blog | | 14+ | Countries seen in one controller's activity | CrowdStrike blog | | 9 | Organizations with confirmed post-exploitation and BLOODALCHEMY | CrowdStrike Intelligence | | 12+ | Additional organizations with password spraying or credential scanning | CrowdStrike blog | | 19 | US organizations in one engagement, across five sectors | CrowdStrike blog | | 1.4 billion | Input tokens used by planning agents in a single intrusion | CrowdStrike blog | Two honest limits apply. First, "targeted" is not "breached": scanning an organization at internet scale costs an agent very little, and most of the 200 may never have been compromised. Second, CrowdStrike sees what its telemetry and the exposed controller show. Its own text says the 1.4 billion token figure for one intrusion implies far higher consumption across the operation as a whole, so the real scale is not known. How ARTEX works, and why it changes the tempo ARTEX coordinates a main agent with subordinate planner and worker agents over a shared graph of facts, findings and goals. Each engagement moves from initial access through host reconnaissance to lateral movement. We covered the project and its English fork in ARTEX Global Edition https://explainx.ai/blog/artex-global-edition-fork-autonomous-pentest-agent-korean-bank-hacks-2026 , including the defender detections its maintainer shipped. The recovered transcripts matter because they show a human still in the loop. An operator issued instructions in Chinese, marked with the label "human instruction" and timestamped in China Standard Time, telling the agents to write web shells, extract domain administrator passwords and inventory endpoint sensor coverage. The AI did the grind, and the human steered at decision points. That is the model security teams should plan for: a skilled operator with the throughput of a small team. One detail stands out. At a global pharmaceutical organization the operator told the agents, in Chinese, to find Windows machines in the domain without the Falcon sensor, judging by the process list and folder listings, using PRC red-team slang for CrowdStrike's product. Building sensor-coverage checks into the agent workflow lets the adversary spend follow-on effort on unprotected hosts. The lesson is not specific to one vendor: any gap in endpoint coverage is now something an agent will look for automatically. Why DeepSeek, and what it does not prove CrowdStrike says VAPOR PANDA ran ARTEX primarily with the Chinese-origin DeepSeek model, supplemented by a second commercial subscription model it could not confirm. The report does not allege that DeepSeek cooperated. The model was used as a widely available backend, which is consistent with how the South Korean case used DeepSeek V4.1 Flash https://explainx.ai/blog/deepseek-v4-1-flash-1017-open-weights-mit-terminal-bench-4-42-benchmarks-pricing-2026 as the primary backend. Two reasonable inferences, flagged as inference: open-weight and cheap models lower the cost of running thousands of agent turns, and attackers pick models by price and refusal behavior, not by flag. US federal agencies have already moved against the vendor's app, as in the DHS order to remove DeepSeek https://explainx.ai/blog/dhs-orders-deepseek-removed-federal-civilian-agencies-procurement-ban-2026 , but a ban on an app does nothing about an API or a downloaded checkpoint driving an attack tool. CrowdStrike's own summary of the lesson is that "adversaries can assemble scalable, multi-agent intrusions largely from publicly available resources". The tooling is open source and the models are rentable or downloadable. How does this connect to other ARTEX reports? ARTEX keeps showing up in separate investigations, which is itself a finding. - South Korea: CrowdStrike linked ARTEX to attacks on Korean financial firms earlier in October, covered in our bank hacks explainer https://explainx.ai/blog/south-korea-ai-bank-hacks-artex-credential-stuffing-october-2026 . - Storm-0940: Microsoft reported a China-aligned group using ARTEX. CrowdStrike says VAPOR PANDA is separate, and reads the overlap as the framework gaining popularity across several China-nexus actors. - Other agent-driven breaches: In India, CERT-In warned about AI agents accessing live systems https://explainx.ai/blog/cert-in-advisory-ai-agents-accessed-indian-organisations-live-systems-2026 , and a hacker using AI agents for $5,000 https://explainx.ai/blog/hacker-ai-agents-5000-dollars-deere-sharkninja-cummins-breach-norforge-cairn-2026 reportedly breached several industrial firms. - The wider picture: our Black October timeline https://explainx.ai/blog/black-october-internet-under-attack-protect-yourself-family-saas-drying-up-2026 tracks the month's AI-assisted incidents. Attribution here comes from the vendor that found it. VAPOR PANDA's identity rests on CrowdStrike's infrastructure links and its tracking since 2021, and outlets such as NBC describe the actor as state-linked. Independent confirmation from a government or second vendor has not been published as of this writing. What should defenders do this week? The attack techniques in the report are ordinary: web shells, credential spraying, domain admin extraction, a known backdoor. The change is volume and parallelism. Practical steps: 1. Close the credential door. Enforce MFA and rate limits on every internet-facing login, including old VPN and webmail endpoints. At least 12 organizations in this campaign were hit with spraying. 2. Audit sensor coverage today. The operator explicitly hunted for hosts without the endpoint agent. A coverage report that shows unmanaged Windows servers is the first thing to fix. 3. Alert on coherent sessions. One source chaining reconnaissance, enumeration, authentication and exploitation, around the clock, is the behavioral fingerprint, more reliable than static user-agent strings that an operator can change. 4. Check for BLOODALCHEMY. CrowdStrike lists indicators in an IOC table at the end of its post. It notes the backdoor was first publicly documented in October 2023, and that one delivery used a renamed GameHook binary loading a malicious DLL. 5. Assume agents on your side too. If your own teams run coding or ops agents, limit what they can reach. The NIST, NSA and CISA ten practices https://explainx.ai/blog/nist-nsa-cisa-ten-practices-si-control-incident-rogue-agents-evidence-no-retention-clock-2026 for controlling agents apply to both sides of this contest. For the defensive side of agents specifically, AgentBeam https://agentbeam.com/?ref=explainx is the agent security platform from the explainx.ai team that stops AI agents before they take dangerous actions. It is aimed at your own coding agents, not at detecting a foreign operator's framework, so treat it as one layer, not a fix for this threat. For related incident analysis, see AgentBeam's write-up on the 123-reg ARTEX claim https://agentbeam.com/blog/123-reg-ai-driven-cyberattack-artex-claimed-vs-verified?ref=explainx . What is still unknown - Whether the nine breaches are the full list. CrowdStrike counts what it could confirm. Other victims may exist that it could not see. - The second model. The commercial LLM subscription was not identified, so which provider's terms were broken is open. - What data left. The report describes access, backdoors and reconnaissance, not a catalog of stolen data. Espionage goals imply exfiltration, but the post does not quantify it. - Government attribution. No agency statement was part of the coverage we reviewed. - Whether the 200 includes repeat or low-effort probes. CrowdStrike says "distinct organizations", but the depth of engagement varies widely from staged files to full compromise. Why it matters beyond this one group The most useful sentence in the report is the one about escalation: single intrusions to multiple simultaneous engagements, run by a human. If one operator can supervise dozens of agent tasks, then the defender's assumption that attackers are limited by headcount weakens. Detection and response times that were fine against a team of five humans may not be against one human and a fleet. The counter-evidence is also real. Nothing in the report suggests new exploit techniques. The agents succeeded using known tradecraft, and the confirmed hit rate was nine out of more than 200, around 4 percent by CrowdStrike's own figures if you count confirmed breaches against targets, though that ratio mixes very different engagement depths. Basic hygiene still stops most of this. For builders, the practical takeaway runs the other way too: the same multi-agent pattern is what coding-agent products use for legitimate work. Attackers get the same cost curve as everyone else, which is why open-weight model price drops https://explainx.ai/blog/deepseek-v4-1-flash-1017-open-weights-mit-terminal-bench-4-42-benchmarks-pricing-2026 matter to security teams as much as to developers. Related reading - South Korea AI bank hacks and ARTEX https://explainx.ai/blog/south-korea-ai-bank-hacks-artex-credential-stuffing-october-2026 - ARTEX Global Edition: the English fork https://explainx.ai/blog/artex-global-edition-fork-autonomous-pentest-agent-korean-bank-hacks-2026 - CERT-In advisory on AI agents in live systems https://explainx.ai/blog/cert-in-advisory-ai-agents-accessed-indian-organisations-live-systems-2026 - Hacker with AI agents breaches Deere, SharkNinja, Cummins https://explainx.ai/blog/hacker-ai-agents-5000-dollars-deere-sharkninja-cummins-breach-norforge-cairn-2026 - Black October: protect yourself https://explainx.ai/blog/black-october-internet-under-attack-protect-yourself-family-saas-drying-up-2026 - NIST, NSA and CISA ten practices for agents https://explainx.ai/blog/nist-nsa-cisa-ten-practices-si-control-incident-rogue-agents-evidence-no-retention-clock-2026 - DHS orders DeepSeek removed from federal agencies https://explainx.ai/blog/dhs-orders-deepseek-removed-federal-civilian-agencies-procurement-ban-2026 - Running tracker of agents affecting third parties: /felony-bench https://explainx.ai/felony-bench Details are accurate as of October 30, 2026, based on CrowdStrike's October 29 post and NBC News reporting. Counts may be revised as CrowdStrike and others publish more.