Vapor Panda: 200+ Organizations Targeted in 11-Day AI-Driven ARTEX Intrusion Campaign

Chinese state-sponsored threat actor Vapor Panda, previously tracked as VexatiousTemper and overlapping with Trend Micro's Earth Estries, used the AI-powered penetration-testing framework ARTEX to target more than 200 organizations across at least 14 countries in an 11-day campaign that began October 17, 2026, according to CrowdStrike's October 29, 2026 analysis. The findings were publicly detailed by CrowdStrike on October 29 and reported by The Hacker News on October 30, 2026.

What was the specific vulnerability?

The exposure was not a single software flaw but the weaponization of ARTEX, a Go-based, AI-powered penetration-testing framework, which Vapor Panda ran from a single controller to conduct simultaneous intrusions against high-value targets. According to CrowdStrike, the framework was run primarily on the Chinese-origin DeepSeek LLM plus a second, unconfirmed subscription-based commercial LLM, coordinating planner and worker agents over a shared graph. A human operator issued instructions in Chinese, labeled 【人类指令】, meaning "human instruction," and timestamped in China Standard Time, steering agents to write web shells, extract domain-administrator passwords and inventory endpoint sensor coverage, including identifying hosts without the CrowdStrike Falcon sensor.

The scale of the agents' autonomous work was substantial: planning agents consumed approximately 1.4 billion input tokens in a single intrusion, per CrowdStrike's October 29, 2026 analysis, a figure also carried by The Hacker News in its October 30, 2026 report. That volume reflects the framework's design, in which a shared graph coordinates planner and worker agents across multiple LLM backends rather than relying on a single model call.

CrowdStrike documented agent-driven techniques including chaining an unsigned SAML assertion with an XXE flaw to query a cloud Instance Metadata Service and obtain a role able to command thousands of instances; combining web shells with an unauthenticated orchestration service for root access in a production container environment, LAPS password reading and resource-based constrained delegation; and using authentication keys unrotated since a 2022 directory export to forge an administrator token and read mailboxes, then extracting VPN configurations from sent mail and using a VPN client key from a purported May 2024 email leak to reach the internal network. ARTEX's developer, Li Puhua, known as "Autumn-27," took the tool closed source after broad adoption by threat actors. Zscaler ThreatLabz, in a report earlier in October 2026, said the framework "orchestrates multiple LLM backends to autonomously perform reconnaissance, vulnerability identification, and exploitation, significantly lowering the technical barrier for conducting complex intrusion campaigns."

How was the incident detected?

The campaign was found by CrowdStrike OverWatch telemetry, which observed the ARTEX controller intermittently exposing adversary tooling, target files and ARTEX agent transcripts. According to CrowdStrike, CrowdStrike Intelligence linked that exposed material to Vapor Panda infrastructure. Campaign activity was observed beginning October 17, 2026, and the company disclosed its findings publicly on October 29, 2026, with The Hacker News reporting the analysis on October 30, 2026. CrowdStrike noted that this campaign is separate from the Storm-0940 ARTEX activity reported by industry sources, and that it had previously documented ARTEX use by financially motivated and unattributed actors.

What is the current impact?

More than 200 distinct organizations across at least 14 countries were targeted, with confirmed post-exploitation at nine organizations and credential attacks against at least 12 more. According to The Hacker News, the nine organizations with confirmed post-exploitation saw deployment of the BLOODALCHEMY backdoor, a ShadowPad derivative, followed by credential spraying, network scanning and reconnaissance. Password-spraying and credential-scanning activity hit at least 12 additional organizations, including U.S. think tanks and European government entities.

Named targets include the foreign ministries of two Latin American countries, with a third likely compromised, a Middle East interior ministry, and one European country's foreign ministry, presidency and prime minister's office plus its defense, justice, finance and intelligence entities. In the United States, 19 organizations were targeted in one engagement, spanning semiconductor, defense, pharmaceutical, nuclear and financial sectors, alongside telecom providers in the U.S., Belgium and the Philippines. CrowdStrike also disclosed four previously undocumented China-nexus groups alongside the campaign: Hollow Panda, Overcast Panda, Titan Panda and Veiled Panda.

What are the next steps?

No patch concept applies to this campaign, because the exposure is espionage-driven intrusion rather than a vulnerable product, and the ARTEX framework itself has been pulled closed source by its developer. Organizations should treat the documented agent-driven techniques as an intrusion playbook: the campaign relied on unrotated authentication keys dating to a 2022 directory export, unauthenticated orchestration services in production container environments, and endpoint sensor coverage gaps that agents were explicitly instructed to map. CrowdStrike's disclosure, dated October 29, 2026, serves as the primary reference for defenders assessing whether their organizations appear among the targeted sectors: foreign ministries, semiconductor, defense, pharmaceutical, nuclear and financial firms, and telecom providers. Neither CrowdStrike nor The Hacker News reported a remediation timeline or victim notifications as of October 30, 2026.

By the numbers

Source snapshot