Threats · 1 day ago
CrowdStrike says VAPOR PANDA used ARTEX, DeepSeek, and another commercial large language model to pursue parallel intrusions against more than 200 organizations beginning October 17, 2026. The activity spanned an 11-day window and included government, defense, semiconductor, and telecommunications targets.
ARTEX is an AI-agent framework that let a human operator direct multiple intrusion tasks at once instead of handling them sequentially. Its instructions also told agents to identify hosts without CrowdStrike Falcon, making sensor gaps part of target selection—not just a blind spot after an intrusion.
For ministries and companies in those sectors, missing Falcon coverage could shape where the campaign proceeds and what defenders can observe. CrowdStrike confirmed post-exploitation activity at nine organizations; its report does not establish how many of the more than 200 targets were compromised.
1 source covering this story
VAPOR PANDA Uses AI-Driven ARTEX to Grow Global Espionage Campaign
CrowdStrike identified a VAPOR PANDA campaign using ARTEX, along with DeepSeek and another commercial LLM, to attack multiple high-value targets.
Part of the PlainSec briefing for 2026-10-30