VAPOR PANDA Ran ARTEX and DeepSeek Against 200+ Organizations: What CrowdStrike Confirmed

CrowdStrike says a China-linked espionage group used an open-source AI agent framework, powered mostly by DeepSeek, to run intrusions against more than 200 organizations in 11 days. The number that matters for defenders is smaller: nine organizations were confirmed breached. The rest were targets, password-spraying victims or staged target files.

The report, published by CrowdStrike OverWatch on October 29, 2026 and picked up by NBC News the same day, is the clearest public case so far of one human operator directing many simultaneous AI-driven engagements. The framework is ARTEX, which we first covered after the South Korean bank hacks. This post separates what CrowdStrike's own write-up confirms from what the headlines compress.

VAPOR PANDA and ARTEX at a glance (TL;DR)

Agents that act on your behalf need rules. See how explainx helps secure your agents →

What did CrowdStrike actually observe?

CrowdStrike OverWatch watched exploitation activity from a single ARTEX controller starting October 17. The controller intermittently exposed adversary tooling, target files and agent transcripts, which is how CrowdStrike could see that multiple engagements, which ARTEX calls "tasks", were running against multiple targets at once.

The reported targets were wide. VAPOR PANDA ran extensive intrusions at the foreign ministries of two Latin American countries, likely compromised a third, and staged target files for ministries in Central America and Asia. It compromised an interior ministry in the Middle East. One engagement went after a single European country's foreign ministry, presidency and prime minister's office, plus defense, justice, finance and intelligence entities. A separate one hit 19 US organizations across pharmaceutical, semiconductor, defense, nuclear and financial sectors, and telecom providers in the US, Belgium and the Philippines were compromised.

CrowdStrike frames this as an escalation: from AI assisting a single intrusion to a human operator running many in parallel. That is the part worth remembering a month from now, whatever happens to the exact counts.

Beads escaping a cracked vessel, a metaphor for VAPOR PANDA ARTEX breaches among 200 targets

200 targeted, nine confirmed: reading the numbers

Most headlines lead with 200. The CrowdStrike text is more careful, and the gap is the story's main caveat.

Two honest limits apply. First, "targeted" is not "breached": scanning an organization at internet scale costs an agent very little, and most of the 200 may never have been compromised. Second, CrowdStrike sees what its telemetry and the exposed controller show. Its own text says the 1.4 billion token figure for one intrusion implies far higher consumption across the operation as a whole, so the real scale is not known.

How ARTEX works, and why it changes the tempo

ARTEX coordinates a main agent with subordinate planner and worker agents over a shared graph of facts, findings and goals. Each engagement moves from initial access through host reconnaissance to lateral movement. We covered the project and its English fork in ARTEX Global Edition, including the defender detections its maintainer shipped.

The recovered transcripts matter because they show a human still in the loop. An operator issued instructions in Chinese, marked with the label "human instruction" and timestamped in China Standard Time, telling the agents to write web shells, extract domain administrator passwords and inventory endpoint sensor coverage. The AI did the grind, and the human steered at decision points. That is the model security teams should plan for: a skilled operator with the throughput of a small team.

One detail stands out. At a global pharmaceutical organization the operator told the agents, in Chinese, to find Windows machines in the domain without the Falcon sensor, judging by the process list and folder listings, using PRC red-team slang for CrowdStrike's product. Building sensor-coverage checks into the agent workflow lets the adversary spend follow-on effort on unprotected hosts. The lesson is not specific to one vendor: any gap in endpoint coverage is now something an agent will look for automatically.

Why DeepSeek, and what it does not prove

CrowdStrike says VAPOR PANDA ran ARTEX primarily with the Chinese-origin DeepSeek model, supplemented by a second commercial subscription model it could not confirm. The report does not allege that DeepSeek cooperated. The model was used as a widely available backend, which is consistent with how the South Korean case used DeepSeek V4.1 Flash as the primary backend.

Two reasonable inferences, flagged as inference: open-weight and cheap models lower the cost of running thousands of agent turns, and attackers pick models by price and refusal behavior, not by flag. US federal agencies have already moved against the vendor's app, as in the DHS order to remove DeepSeek, but a ban on an app does nothing about an API or a downloaded checkpoint driving an attack tool.

CrowdStrike's own summary of the lesson is that "adversaries can assemble scalable, multi-agent intrusions largely from publicly available resources". The tooling is open source and the models are rentable or downloadable.

How does this connect to other ARTEX reports?

ARTEX keeps showing up in separate investigations, which is itself a finding.

• South Korea: CrowdStrike linked ARTEX to attacks on Korean financial firms earlier in October, covered in our bank hacks explainer.
• Storm-0940: Microsoft reported a China-aligned group using ARTEX. CrowdStrike says VAPOR PANDA is separate, and reads the overlap as the framework gaining popularity across several China-nexus actors.
• Other agent-driven breaches: In India, CERT-In warned about AI agents accessing live systems, and a hacker using AI agents for $5,000 reportedly breached several industrial firms.
• The wider picture: our Black October timeline tracks the month's AI-assisted incidents.

Attribution here comes from the vendor that found it. VAPOR PANDA's identity rests on CrowdStrike's infrastructure links and its tracking since 2021, and outlets such as NBC describe the actor as state-linked. Independent confirmation from a government or second vendor has not been published as of this writing.

What should defenders do this week?

The attack techniques in the report are ordinary: web shells, credential spraying, domain admin extraction, a known backdoor. The change is volume and parallelism. Practical steps:

1. Close the credential door. Enforce MFA and rate limits on every internet-facing login, including old VPN and webmail endpoints. At least 12 organizations in this campaign were hit with spraying.
2. Audit sensor coverage today. The operator explicitly hunted for hosts without the endpoint agent. A coverage report that shows unmanaged Windows servers is the first thing to fix.
3. Alert on coherent sessions. One source chaining reconnaissance, enumeration, authentication and exploitation, around the clock, is the behavioral fingerprint, more reliable than static user-agent strings that an operator can change.
4. Check for BLOODALCHEMY. CrowdStrike lists indicators in an IOC table at the end of its post. It notes the backdoor was first publicly documented in October 2023, and that one delivery used a renamed GameHook binary loading a malicious DLL.
5. Assume agents on your side too. If your own teams run coding or ops agents, limit what they can reach. The NIST, NSA and CISA ten practices for controlling agents apply to both sides of this contest.

For the defensive side of agents specifically, AgentBeam is the agent security platform from the explainx.ai team that stops AI agents before they take dangerous actions. It is aimed at your own coding agents, not at detecting a foreign operator's framework, so treat it as one layer, not a fix for this threat. For related incident analysis, see AgentBeam's write-up on the 123-reg ARTEX claim.

What is still unknown

• Whether the nine breaches are the full list. CrowdStrike counts what it could confirm. Other victims may exist that it could not see.
• The second model. The commercial LLM subscription was not identified, so which provider's terms were broken is open.
• What data left. The report describes access, backdoors and reconnaissance, not a catalog of stolen data. Espionage goals imply exfiltration, but the post does not quantify it.
• Government attribution. No agency statement was part of the coverage we reviewed.
• Whether the 200 includes repeat or low-effort probes. CrowdStrike says "distinct organizations", but the depth of engagement varies widely from staged files to full compromise.

Why it matters beyond this one group

The most useful sentence in the report is the one about escalation: single intrusions to multiple simultaneous engagements, run by a human. If one operator can supervise dozens of agent tasks, then the defender's assumption that attackers are limited by headcount weakens. Detection and response times that were fine against a team of five humans may not be against one human and a fleet.

The counter-evidence is also real. Nothing in the report suggests new exploit techniques. The agents succeeded using known tradecraft, and the confirmed hit rate was nine out of more than 200, around 4 percent by CrowdStrike's own figures if you count confirmed breaches against targets, though that ratio mixes very different engagement depths. Basic hygiene still stops most of this.

For builders, the practical takeaway runs the other way too: the same multi-agent pattern is what coding-agent products use for legitimate work. Attackers get the same cost curve as everyone else, which is why open-weight model price drops matter to security teams as much as to developers.

Related reading

• South Korea AI bank hacks and ARTEX
• ARTEX Global Edition: the English fork
• CERT-In advisory on AI agents in live systems
• Hacker with AI agents breaches Deere, SharkNinja, Cummins
• Black October: protect yourself
• NIST, NSA and CISA ten practices for agents
• DHS orders DeepSeek removed from federal agencies
• Running tracker of agents affecting third parties: /felony-bench

Details are accurate as of October 30, 2026, based on CrowdStrike's October 29 post and NBC News reporting. Counts may be revised as CrowdStrike and others publish more.