Understand this story
On October 29, 2026, CrowdStrike Intelligence released a report stating that the China-linked group VAPOR PANDA used the AI-driven ARTEX intrusion framework to target more than 200 organizations in at least 14 countries over an 11-day period beginning October 17, 2026, and confirmed post-compromise activity at 9 of them. The report states that ARTEX relies primarily on the DeepSeek large language model, supplemented by another commercial model, with a main agent and planning and execution sub-agents sharing a fact and goal graph; in a single intrusion, the planning agent consumed approximately 1.4 billion input tokens, and operators issued instructions in Chinese and intervened at key junctures. CrowdStrike also stated that the group deployed the BLOODALCHEMY backdoor at some targets, and predicted that China-linked adversaries will increasingly adopt such agent frameworks over the next 12 months. The report was covered by Unite.AI on October 30, 2026, and there are no subsequent developments as of yet.
AI-generated from public reports
Latest development · Report
CrowdStrike says VAPOR PANDA attacked more than 200 organizations using the DeepSeek-driven ARTEX frameworkDevelopments
1 confirmed developments
Reports and discussion timeline
Browse reports and discussion by time. Their evidence levels remain distinct.
Oct 30
Unite.AISelected
CrowdStrike says VAPOR PANDA attacked more than 200 organizations using the DeepSeek-driven ARTEX framework
CrowdStrike's report states that the China-linked group VAPOR PANDA used an AI-driven intrusion framework called ARTEX, built primarily on the DeepSeek large language model with another commercial model as a secondary component, to target more than 200 organizations in at least 14 countries over 11 days starting October 17, 2026, and confirmed post-compromise activity at 9 of them. ARTEX consists of a main agent and planning and execution sub-agents that share a fact and goal graph; in a single intrusion the planning agent consumed about 1.4 billion input tokens, and operators issued commands in Chinese and intervened at key junctures. CrowdStrike also says the group deployed the BLOODALCHEMY backdoor at some targets, and predicts that China-linked adversaries will increasingly adopt such agent frameworks over the next 12 months.