China-Linked VAPOR PANDA Runs 200+ AI-Driven Intrusions via ARTEX
Global – October 31, 2026 -- The China-nexus adversary VAPOR PANDA used the agentic framework ARTEX to target more than 200 organizations worldwide, according to CrowdStrike OverWatch. The campaign paired the Chinese-developed DeepSeek large language model (LLM) with a second commercial LLM to run intrusions against multiple high-value targets in parallel. CrowdStrike calls it an escalation in China-nexus use of AI agents, from single intrusions to simultaneous engagements directed by one human operator.
Campaign reached at least 14 countries in 11 days
Exploitation activity began on October 17, 2026, from a single ARTEX controller linked to VAPOR PANDA infrastructure. Targets included foreign ministries in Latin America, Europe, Asia and the Middle East. U.S. semiconductor, defense and think tank organizations were also hit, along with telecommunications providers in multiple regions.