VAPOR PANDA coordinated parallel intrusions across 14 countries
CrowdStrike says VAPOR PANDA used one ARTEX controller to direct intrusions against more than 200 organizations in at least 14 countries during an 11-day campaign that began Oct. 17, 2026.
ARTEX’s planner and worker agents divided reconnaissance, credential theft, lateral movement, and web-shell deployment across simultaneous operations, while a human operator made key decisions. CrowdStrike confirmed post-exploitation at nine organizations, including deployment of the BLOODALCHEMY backdoor and credential spraying. The agents also identified Windows systems without CrowdStrike Falcon, putting endpoint coverage into the campaign’s reconnaissance.
For organizations in the reported sectors and regions, Falcon gaps belong in the campaign’s exposure picture. CrowdStrike has confirmed activity at nine of more than 200 targeted organizations, but has not said what happened at the others.