The VAPOR PANDA ARTEX campaign is the focus of a new CrowdStrike threat report describing a China-nexus espionage operation that the vendor says combined human direction with AI agents capable of conducting hundreds of intrusions in parallel. CrowdStrike OverWatch observed activity beginning on October 17, 2026, against more than 200 organisations across at least 14 countries. The report is CrowdStrike’s own characterisation of the campaign and has not been independently peer reviewed, so its target list and technical findings should be treated as vendor intelligence rather than independently verified fact.
According to CrowdStrike, the operator used ARTEX, a Go-based multi-agent penetration-testing framework originally released as an open-source project for authorised security testing and later made proprietary, to coordinate simultaneous engagements against government, defence, pharmaceutical, semiconductor, nuclear and financial organisations. VAPOR PANDA is a China-based targeted intrusion group first identified in February 2021 that overlaps with the threat cluster Trend Micro calls Earth Estries.
How ARTEX Enabled Hundreds of Parallel Intrusions
CrowdStrike describes ARTEX as a hierarchy in which a main agent works with subordinate planner and worker agents. They share a graph containing facts, findings and goals, allowing discoveries from one part of an engagement to inform other tasks. The system can move through initial access, host reconnaissance and lateral movement while pursuing web applications, cloud services, container environments, Active Directory, mail and VPN infrastructure.
This architecture allowed one controller to maintain multiple engagements at once. The agents could test several attack paths in parallel and shift when an approach failed, reducing some of the repetitive workload associated with manual intrusion activity. The report says planning agents consumed on the order of 1.4 billion input tokens during one intrusion. That figure is CrowdStrike’s measurement from recovered activity and indicates how much information was processed, although it does not establish the exact total consumption across the whole operation.
DeepSeek, a Chinese-origin large language model, was the principal model used in the observed activity. CrowdStrike also saw a second subscription-based commercial model, but the vendor could not identify it. Using more than one provider may give the operator flexibility if one service becomes unavailable or imposes restrictions. The presence of a human remained important. Recovered transcripts showed instructions written in Chinese and marked with a label meaning human instruction, with the operator directing agents toward objectives and correcting their course at decision points.
The VAPOR PANDA ARTEX campaign Targeted Sensitive Institutions
The targets listed by CrowdStrike included the foreign ministries of two Latin American countries, with a third foreign ministry described as likely compromised but not independently confirmed. A Middle East interior ministry was also compromised according to the vendor. One European country was targeted through its foreign ministry, presidency and prime minister’s office, along with defence, justice, finance and intelligence agencies.
Another engagement focused on 19 United States organisations in the pharmaceutical, semiconductor, defence, nuclear and financial sectors. Telecommunications providers in the United States, Belgium and the Philippines were also compromised, while credential spraying and scanning were observed against at least 12 additional organisations, including United States think tanks and government entities in Europe. CrowdStrike confirmed post-exploitation at nine organisations, but this should not be read as a complete count of every successful compromise. CyberScoop reported that about 70 percent of targets were confirmed compromised or showed moderate-confidence evidence of intrusion, according to CrowdStrike.
The campaign widened VAPOR PANDA’s established focus. Since 2021, the group has primarily pursued government, think tank, energy and extractive organisations in Europe, North America, Oceania and the United Kingdom, generally seeking durable access. CrowdStrike views the pharmaceutical, semiconductor, nuclear and defence targeting, along with new geographic areas, as an expansion of that mission rather than a wholesale change in strategy.
BLOODALCHEMY and ShadowPad Link Espionage to Established Malware
At nine organisations where CrowdStrike confirmed post-exploitation, the operator gained access, deployed the BLOODALCHEMY backdoor and then conducted credential spraying, network scanning and reconnaissance. BLOODALCHEMY is a derivative of ShadowPad, a modular malware family associated in public reporting with China-nexus activity. CrowdStrike first publicly documented BLOODALCHEMY in October 2023.
The report says the adversary used a legitimate GameHook binary renamed as a Windows system executable to load a malicious library that decrypted the BLOODALCHEMY payload. Copies of the components were staged in exposed directories, and the implant communicated with infrastructure associated with VAPOR PANDA. CrowdStrike said these indicators were absent from earlier public reporting on ARTEX and provided additional detail about command-and-control infrastructure.
At one global pharmaceutical organisation, the operator instructed agents to identify domain-connected Windows machines that lacked the CrowdStrike Falcon sensor. CrowdStrike interprets this as evidence that endpoint visibility was built directly into the agentic workflow, allowing follow-on activity to focus on systems considered less protected. The vendor has previously seen VAPOR PANDA and other actors use AI assistants in individual intrusions, but says this operation marks a notable shift toward multiple simultaneous engagements.
Why AI Agents Change the Economics of Espionage
The main change is not that ARTEX creates novel attack methods. It automates coordination. Agents can pursue many paths, share findings and make rapid decisions under a human operator’s strategic direction. CyberScoop quoted CrowdStrike executive Adam Meyers saying command activity could exceed 1,500 per hour, compared with a typical ceiling of about 40 per hour in hands-on-keyboard activity tracked by the company over the past 15 years. Those are CrowdStrike figures presented in the reporting and should not be treated as universal benchmarks.
That scale may allow a small team to maintain a broad access-development operation at a lower human cost. It also complicates defensive analysis because each task can involve many rapid actions across separate environments. The agents did not replace human judgement in the activity CrowdStrike observed. Instead, the human supplied goals, selected priorities and intervened when automated plans needed redirection. The division of labour made the framework useful for sustained espionage rather than merely short experiments with generative AI.
ARTEX was initially available as an open-source resource, and its later closure did not erase copies already circulating. CrowdStrike and other reporting have also connected ARTEX use to Storm-0940, while the vendor states that the VAPOR PANDA activity is separate from the ARTEX campaign Microsoft attributed to Storm-0940. The distinction matters because researchers and defenders may otherwise combine activity attributed to different operators. A tool can be shared across threat clusters while campaigns, infrastructure and tradecraft remain distinct.
What Defenders Should Learn From the Findings
For defenders, the report’s most important point is that agentic tooling changes speed, concurrency and operational reach. The observations are CrowdStrike’s own, but they are consistent with a broader security concern: teams should expect intrusions to involve more simultaneous paths, faster credential attempts and less human time between discovery and action. Monitoring focused only on a single suspicious process may miss the wider pattern across endpoints, identity systems, cloud services and network infrastructure.
Centralised logging, strong identity boundaries, rapid credential rotation and attention to unusual administrative behaviour become more valuable when many automated tasks can run at once. Security teams should also examine whether defensive coverage is uneven across domain-connected systems, because the VAPOR PANDA ARTEX campaign reportedly included direct efforts to locate machines without endpoint sensors. Organizations in the sectors named by CrowdStrike may need to map their exposure across internet-facing appliances, remote access services, cloud administration and supplier relationships.
AI does not remove the need for skilled operators, and ARTEX did not make every task succeed. It gives an operator a way to coordinate many attempts and extract more value from each intervention. That balance between machine speed and human direction is the central lesson of CrowdStrike’s report. As the vendor cautions that China-nexus actors are likely to continue adopting agentic frameworks, defenders should prepare for operations that look less like a linear intrusion and more like many connected lines of effort moving at once. The VAPOR PANDA ARTEX campaign is CrowdStrike’s own characterisation of an active campaign, and nothing in it has been independently reproduced, so the honest place to leave it is a vendor report describing what its own telemetry showed and how far agentic intrusion has moved from a single operator’s one-off intrusion to a portfolio.
CrowdStrike’s findings portray the VAPOR PANDA ARTEX campaign as an escalation in AI-assisted espionage, with hundreds of organisations targeted and confirmed post-exploitation at nine sites. The figures remain the vendor’s own assessment rather than an independently peer-reviewed study, but the reported architecture and operating pattern provide a serious warning that agentic tools can turn a small intrusion team into a much broader operation.