CrowdStrike: China-Linked Vapor Panda Ran ARTEX AI Agents on DeepSeek Against 200+ Organizations in 11 Days

A China-based hacking group handed the grunt work of espionage to AI agents and aimed them at more than 200 organizations in under two weeks, according to CrowdStrike.

The firm published its analysis Thursday, Oct. 29. It attributes the activity to Vapor Panda, a group it first identified in February 2021 and formerly tracked as VexatiousTemper. CrowdStrike says the group overlaps with a cluster Trend Micro calls Earth Estries.

What CrowdStrike found

Starting Oct. 17, a single controller running ARTEX directed intrusion attempts against targets in at least 14 countries. CrowdStrike lists foreign ministries in Latin America, Europe, Asia and the Middle East. It also lists semiconductor, defense and think tank organizations in the U.S., and telecom providers in multiple regions.

CyberScoop reports the target list also includes a European country's presidency and prime minister's office, plus defense and intelligence agencies. It says 19 U.S.-based organizations in pharmaceutical, semiconductor, defense, nuclear and financial sectors were among them. Telecom providers in the United States, Belgium and the Philippines are named.

CrowdStrike confirmed post-exploitation activity at nine organizations. There, the attackers deployed BLOODALCHEMY, a derivative of the ShadowPad backdoor, then moved to credential spraying, network scanning and reconnaissance. The group also ran password-spraying and credential-scanning against at least 12 more, including U.S. think tanks and European government entities.

Nine confirmed, or about 140?

The numbers differ depending on the yardstick. CrowdStrike's published analysis counts nine confirmed post-exploitation cases.

CrowdStrike also told CyberScoop that about 70% of the targets were either confirmed compromised or showed evidence indicating moderate confidence of a successful intrusion. CyberScoop puts that at roughly 140 targets. CrowdStrike has not publicly reconciled the two figures.

How the machine works

ARTEX is a Go-based, AI-powered penetration-testing framework. A security engineer published it as open source on GitHub this year, according to the account of CrowdStrike's findings. Pen-testing tools exist for legitimate defenders. Here, the group pointed one at foreign governments.

Vapor Panda ran it primarily on DeepSeek, the Chinese-developed model, plus a second subscription-based commercial model CrowdStrike could not identify. Planner and worker agents coordinate toward a goal, moving from initial access to host reconnaissance and lateral movement. A human operator stays in the loop, directing agents to write web shells, extract domain administrator passwords and enumerate endpoint sensor coverage.

The scale is the story. In a single intrusion, the planning agents consumed on the order of 1.4 billion input tokens, CrowdStrike said.

"This is the first time that we're seeing an agentic adversary nation-state threat actor at this scale, and I think that this is probably, unfortunately, something we'll see more of," Adam Meyers, CrowdStrike's senior vice president of counter adversary operations, told CyberScoop.

Meyers said hands-on-keyboard activity CrowdStrike has tracked for 15 years typically involved up to 40 commands per hour. "Now, with ARTEX, we could see it exceed 1,500 commands an hour," he said. Requests can fire as often as every 10 seconds. He said that makes mass exploitation cheap: "If you diversify that across 200 targets, it costs them very little."

CrowdStrike's own framing is measured. In its words, agentic tooling lets "a small team" pursue a wider target set than manual operations would support, "rather than a wholesale shift away from the adversary's established access-development mission."

Meyers characterized the targeting as "a diverse operational mission that tends to focus on sectors and geographies that Beijing considers economically or politically important." He said the campaign remains active. He also said malicious agentic AI use is growing almost threefold month over month.

A separate case: Microsoft and ConnectWise

Microsoft Threat Intelligence published its own findings on ARTEX earlier this month. It attributes activity to Storm-0940, a China state-aligned actor active since 2021 and, by Microsoft's account, using ARTEX as early as September 2026 against hundreds of organizations. CyberScoop reports CrowdStrike treats that activity as separate from the Vapor Panda campaign.

Microsoft says that in multiple cases Storm-0940 went from initial targeting to privileged cloud access in under three hours. It assesses the actor was behind the recently disclosed compromise of ConnectWise's Cloud Backup application credentials, formerly SkyKick. Those credentials let the attackers exploit access customers had already granted to ConnectWise applications in Microsoft 365, with no interactive user sign-in needed.

Microsoft stresses the activity did not stem from a compromise of, or vulnerability in, its own systems. It also cautions that a successful authentication does not necessarily mean customer data was accessed or exfiltrated.

ConnectWise disabled the affected application connections, which interrupted Cloud Backup plus the SaaS Security and Cloud Management services. It said it found no indication customer backup data was compromised. CEO Manny Rivelo said the company's evidence, including intelligence shared by Microsoft, points to a China state-aligned group.

Rivelo added a warning: securing ConnectWise's systems "do[es] not remove unauthorized access that may already have been established within individual customer tenants, which require separate review."

What happens next

In its Oct. 26 update, ConnectWise said it is preparing a phased restoration of Cloud Backup, with access to existing backups first and full service re-enrollment later. It has not said when partners can begin restoring data. It told customers to keep affected connections disabled until it issues instructions and to examine their Microsoft 365 environments.

On the Vapor Panda side, CrowdStrike says the campaign is still running. The nine confirmed intrusions are the firm's hard count so far, and the larger 70% figure it gave CyberScoop has no published breakdown of victims.