Last changed Oct 30, 2026

CrowdStrike: China-nexus VAPOR PANDA ran ARTEX AI agents, mainly on DeepSeek, against 200-plus organizations in 14 countries in 11 days and got inside nine

VAPOR PANDA (China-nexus adversary, per CrowdStrike); ARTEX (open-source multi-agent framework); DeepSeek's LLM plus an unidentified subscription commercial LLM; CrowdStrike Intelligence; foreign ministries, government offices and US pharmaceutical, semiconductor, defense, nuclear and financial organizations

CrowdStrike reported on Oct 29 that VAPOR PANDA, a China-nexus adversary, used ARTEX, an open-source agent framework in which a main agent coordinates planner and worker agents, against more than 200 distinct organizations in at least 14 countries over an 11-day window beginning Oct 17, 2026. It ran primarily on the Chinese-origin DeepSeek LLM, supplemented by a second subscription-based commercial LLM CrowdStrike could not confirm. CrowdStrike confirmed post-exploitation activity at nine organizations, where the adversary gained access and deployed the BLOODALCHEMY backdoor, and password-spraying and credential scanning against at least 12 more. Targets included foreign ministries in Latin America, Europe, Asia and the Middle East, a European country's foreign ministry, presidency and prime minister's office, and 19 US organizations in pharmaceuticals, semiconductors, defense, nuclear and finance; against a Greek government entity the agent forged an administrator token and read mailboxes. A human operator issued instructions in Chinese and intervened mainly to steer the agents at decision points; one intrusion's planning agents consumed on the order of 1.4 billion input tokens. CrowdStrike names no victim and does not state that data was exfiltrated.