VAPOR PANDA scales espionage by seeking Falcon gaps
CrowdStrike says VAPOR PANDA used ARTEX, DeepSeek, and another commercial large language model to pursue parallel intrusions against more than 200 organizations beginning October 17, 2026. The activity spanned an 11-day window and included government, defense, semiconductor, and telecommunications targets.
ARTEX is an AI-agent framework that let a human operator direct multiple intrusion tasks at once instead of handling them sequentially. Its instructions also told agents to identify hosts without CrowdStrike Falcon, making sensor gaps part of target selection—not just a blind spot after an intrusion.
For ministries and companies in those sectors, missing Falcon coverage could shape where the campaign proceeds and what defenders can observe. CrowdStrike confirmed post-exploitation activity at nine organizations; its report does not establish how many of the more than 200 targets were compromised.