- CrowdStrike says the China-linked group VAPOR PANDA used the AI framework ARTEX against more than 200 organizations in at least 14 countries over 11 days.
- A human operator directed several engagements in parallel, and the agents were told to find machines without CrowdStrike's sensor. That check lets the attacker focus on unprotected hosts.
- Leaders should ask whether every host has endpoint protection, who can reach cloud credential services, and whether alerts can keep pace with machine speed.
The limit on intrusions was people
For years, human attention limited hacking campaigns. Each break-in needed someone to read results, pick a path and type the next command. CrowdStrike's new report describes what happens when software does most of that work.
CrowdStrike's OverWatch threat hunters found a campaign by VAPOR PANDA, a group CrowdStrike links to China. It began on October 17, 2026. The group used an AI framework called ARTEX against more than 200 organizations.
CrowdStrike saw activity aimed at entities in at least 14 countries over 11 days. All of it came from one ARTEX controller. That controller sometimes left its tools, target files and agent transcripts exposed. This is how CrowdStrike could see the work.
The targets span many sectors. CrowdStrike names foreign ministries in Latin America, Europe, Asia and the Middle East. It also names telecom providers in the U.S., Belgium and the Philippines that the group compromised. One engagement aimed at 19 U.S. organizations across five sectors: drugs, chips, defense, nuclear and finance.
How ARTEX works
ARTEX is a team of software agents. A lead agent hands work to planner agents and worker agents. All of them read from and write to a shared record of facts, findings and goals.
Each engagement moves in stages. First comes initial access. Then the agents map the hosts. Then they move sideways, hopping from one machine to the next.
CrowdStrike says the agents ran mainly on DeepSeek, a Chinese-origin model. A second, paid model supplemented it, and CrowdStrike could not identify that one. In one intrusion, the planning agents used about 1.4 billion input tokens. Tokens are the chunks of text a model reads. CrowdStrike says this implies far higher use across the whole operation.
A person stayed in the loop. Recovered transcripts show an operator giving orders in Chinese. They carry a "human instruction" label and China Standard Time stamps. The operator stepped in to steer the agents at decision points.
CrowdStrike's assessment is that this setup likely lets a single operator attempt more techniques against more targets than manual work would allow. It also says a small team could pursue a wider target set. The transcripts show an operator issuing instructions, but they do not prove one person ran everything.
Speed is the difference. CrowdStrike's Adam Meyers told CyberScoop that past hands-on-keyboard activity ran up to 40 commands an hour. With ARTEX, he said, it could exceed 1,500. CyberScoop also reported requests as often as every 10 seconds.
The agents hunted for unprotected machines
At a global drug company, the operator told the agents to look for Windows machines on the network that lack CrowdStrike's Falcon sensor. The agents were to judge from running-process lists and folder listings. The order was written in Chinese. CrowdStrike says the word it used for Falcon is slang among Chinese red teams for the sensor.
CrowdStrike says this check lets the attacker focus later steps on unprotected hosts. The lesson is plain. Any gap in endpoint coverage can be searched for automatically, and this order shows the step built into the agents' workflow.
Other steps were not exotic. At one U.S. drug maker, CrowdStrike says the agent combined two flaws. One was a login assertion that was never signature-checked. The other was an XML flaw that makes a server fetch data it should not. Together they reached the cloud metadata service. That gave a role able to send administration commands to thousands of instances.
What the numbers do and do not show
Scale needs care. CrowdStrike confirmed that attackers got in and acted afterward at nine organizations. It also saw password spraying against at least 12 more.
CrowdStrike told CyberScoop that about 70% of targets were confirmed compromised or showed moderate-confidence signs of intrusion. CyberScoop's figure of about 140 compromised targets rests on that estimate. So "200 targets" does not mean 200 breaches.
The group is not new. CrowdStrike says VAPOR PANDA has gone after government, think tank, energy and mining-related groups since 2021. This is its first observed use of AI-driven tools. CrowdStrike says the campaign is separate from the ARTEX activity Microsoft attributed to Storm-0940.
CyberScoop reported that CrowdStrike saw about 45 agentic attacks by adversaries in September and 126 in October. That is two months of one vendor's data. It shows direction, not a settled rate.
Questions to put to your team
Meyers said the techniques are familiar. The speed and scale are not. That points to practical checks.
First, can your team list every server and workstation that lacks endpoint protection today? The order CrowdStrike observed went looking for exactly that list.
Second, who and what can reach your cloud metadata service? Do your login systems reject unsigned assertions? Third, would your monitoring spot a login or command pattern at machine pace, or does it assume a person typing?
Fourth, does your security contract cover the hosts you really have, including old ones? Coverage that stops at the edge of the inventory helps the attacker.
When attention is cheap for the attacker, every unmanaged machine is a place an agent like this can concentrate on.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: CrowdStrike.
