VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign
CrowdStrike OverWatch has identified a VAPOR PANDA cyberespionage campaign utilizing the ARTEX agentic framework alongside the DeepSeek LLM and a second commercial model to conduct parallel intrusions against over 200 organizations worldwide. Beginning on October 17, 2026, the adversary targeted foreign ministries, defense sectors, and telecommunications providers across multiple regions while deploying the BLOODALCHEMY backdoor and incorporating endpoint sensor evasion into their workflows. Open article →
- China-backed threat group used agentic AI pentesting tool to compromise 140 sensitive targets in 11 days
- Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide
- CrowdStrike: China-linked hackers used AI tool ARTEX with a DeepSeek LLM and another model to target 200+ organizations in 11 days, compromising at least nine
- CrowdStrike: Vapor Panda ran intrusions with DeepSeek-based agents
- This is what I've been worried about: the techniques are old, but agents make mass exploitation c...