CrowdStrike says China-linked VAPOR PANDA ran ARTEX AI agents against 200+ organizations and confirms post-exploitation at nine

ARTEX is not an AI model. Google's threat researchers describe it as "an autonomous, multi-agent LLM-driven pentesting and offensive command-and-control (C2) platform written in Go with an embedded Next.js web console" and say a user called Autumn-27 originally released it on GitHub. Its users connect it to a model of their choice. The developer said on October 8 that the project was meant for authorized security testing and would go closed source because of misuse, and Reuters found the GitHub page taken down. Google says copies keep spreading through forks, including a commercial version called ARTEX PRO. The original repository address returned HTTP 404 when checked for this record; no ARTEX code was downloaded or run. (Google; Microsoft; Autumn-27 statement; Reuters via The Straits Times)

CrowdStrike says its OverWatch hunters saw exploitation from a single ARTEX controller, starting October 17, that "intermittently exposed adversary tooling, target files, and ARTEX agent transcripts." Foreign ministries in Latin America, Europe, Asia and the Middle East were among the targets. One engagement focused on a single unnamed European country, including its foreign ministry, presidency and prime minister's office; CrowdStrike does not say whether that country is Greece. Another targeted 19 US organizations in the pharmaceutical, semiconductor, defense, nuclear and financial sectors. CrowdStrike says VAPOR PANDA ran ARTEX "primarily" with DeepSeek, with a second subscription-based commercial model it "could not confirm." It adds: "In a single intrusion, VAPOR PANDA’s planning agents consumed on the order of 1.4 billion input tokens". (CrowdStrike)

CrowdStrike gives three examples from the transcripts and staged tools. At one US pharmaceutical organization, an agent chained an unsigned login assertion (SAML) and an XML parsing flaw to query the cloud metadata service, obtained a role able to issue administration commands to thousands of instances, and later recovered an enterprise administrator account. At a second, an agent deployed web shells, abused an unauthenticated orchestration service to gain root in a production container environment, and read local administrator passwords. At a Greek government entity, the operator gave the agent a 2022 directory export from the mail server, containing keys that had "likely not been rotated"; the agent forged an administrator token, read mailboxes, and reached the internal network using VPN settings from a user's sent mail plus a VPN key the operator said came from a May 2024 email leak. CrowdStrike reports BLOODALCHEMY, a backdoor Elastic documented in 2023, at a Middle Eastern interior ministry and a Latin American foreign ministry. Its summary of the nine says BLOODALCHEMY was deployed at them, but only those two deployments are described. (CrowdStrike)

A human operator stayed involved, by CrowdStrike's account. Instructions marked 【人类指令】 ("human instruction") and timestamped in China Standard Time directed agents to write web shells, extract domain administrator passwords and inventory endpoint sensor coverage. CrowdStrike also reports that at a global pharmaceutical organization the operator told agents to "find Windows machines in the domain without Falcon, judging by tasklist and folder listings" and says the Chinese word used is red-team slang for its own Falcon sensor. CrowdStrike sells that product, and its recommendations include deploying "an advanced, real-time endpoint detection and response (EDR) agent, such as the CrowdStrike Falcon sensor". The transcripts are not public, so the instruction and its translation are known only through CrowdStrike. (CrowdStrike)

The link to China is a single vendor's assessment. CrowdStrike says it "has linked" the controller to VAPOR PANDA infrastructure and that BLOODALCHEMY communicated with that infrastructure, and it publishes three domains, three IP addresses and three file hashes, but not how it made the link. Its adversary profile labels the group "China-based" and "State-Sponsored" without stating evidence. Chinese-language instructions and China Standard Time stamps show language and clock settings, not a sponsor. ARTEX and DeepSeek do not identify an actor either: CrowdStrike tied ARTEX and DeepSeek to a likely financially motivated unattributed actor, and Microsoft reports ARTEX use by North Korean groups. This research found no government attribution and no outside firm's analysis of the published indicators.

Four nearby items are separate from this event. CrowdStrike calls this campaign separate from Microsoft's Storm-0940 report, which concerns the ConnectWise compromise. TeamT5's finding that state-affiliated groups more than doubled their attacks after adopting AI, reported by Bloomberg in August, predates the campaign and names other groups. Wiz's note that 23.106.46.239 hosted an "ARTEX — autonomous penetration testing console" page on October 8 concerns an AI-key reseller, and nothing reviewed links it to VAPOR PANDA. The Board's record IB-2026-006, on Anthropic's report of AI-assisted Russian espionage, concerns a different actor and event.

Open-source ARTEX harness (copies circulate after the original was withdrawn)
  -> operator connects DeepSeek and an unconfirmed second commercial model
     [hosted service or self-run model: not stated]
  -> operator supplies target files and instructions in Chinese to one controller
  -> planner and worker agents try several paths at once
     (web apps, cloud, containers, Active Directory, mail, VPN)
  -> in the reported cases, weak victim controls give way
     (unsigned SAML + XML flaw; unauthenticated orchestration service;
      2022 keys "likely" unrotated, plus VPN material from mail and an older leak)
  -> administrator access, mailbox reading, BLOODALCHEMY backdoor
     [confirmed at nine organizations; data removed: unknown]

Every step above comes from CrowdStrike's account. Two boundaries are visible in it. The first belongs to the victims: CrowdStrike's examples turn on logins that accepted unsigned assertions, a service with no authentication, and keys left unchanged after an old exposure. CrowdStrike describes "well-established tradecraft" alongside the AI workflow, and CyberScoop reports Adam Meyers saying the attacks show nothing new: "it’s just doing it at a speed and scale that we’re unaccustomed to". The second is the point where a general-purpose model takes intrusion instructions. The report does not say whether DeepSeek or the second model refused anything, whether a provider's safeguards applied, or whether DeepSeek ran on DeepSeek's servers or on copies of its openly available models, so that boundary's failure is not established. TeamT5's chief analyst has said DeepSeek has "very low cyber guardrails," but that is a general view from separate work, not a finding about this campaign. ARTEX's role is speed and parallel work, not a new weakness. (CrowdStrike; CyberScoop; Bloomberg via Deccan Chronicle)

CrowdStrike's account places government ministries, telecommunications providers and pharmaceutical companies among those reached. NBC text quoted by HotAir lists nine as "significantly compromised": two US pharmaceutical companies, a Middle Eastern interior ministry, two Latin American foreign ministries, a Greek government entity and telecommunications companies in the US, Belgium and the Philippines. "Significantly compromised" is NBC's phrase; CrowdStrike's post does not present that list as the nine, though the items it describes add up to that number. Which of these bodies suffered what harm is unknown. No loss figure, data volume, service disruption or downstream misuse appears in the sources reviewed. (HotAir; CrowdStrike)

The speed claims are also CrowdStrike's. Meyers told CyberScoop that hands-on intrusions typically involved up to 40 commands per hour and that with ARTEX "we could see it exceed 1,500 commands an hour," and CrowdStrike gave CyberScoop counts of roughly 45 agentic attacks in September and 126 in October so far. None of these numbers has a published method. CrowdStrike also assesses that China-nexus adversaries will "highly likely" keep adopting such frameworks; that is a forecast. Outside views are limited. Google researcher Rohit Nambiar told iTnews there is no evidence that fully autonomous hacking "is here yet," speaking of activity in Google's report, not VAPOR PANDA. Ollie Whitehouse's weekly newsletter said the campaign's use of agents picked "very low hanging fruit which would likely not be present were the fundamentals followed." (CyberScoop; iTnews; CTO at NCSC)

Later commentary has gone beyond the evidence. Aviatrix writes that the framework exfiltrated sensitive data and lists "classified diplomatic communications" among exposed data; neither CrowdStrike's report nor CyberScoop says that. This record does not adopt those claims.

CrowdStrike, the reporting party, published indicators and recommendations, including key rotation, SAML signature enforcement, hunting for ARTEX markers and endpoint sensor deployment. It has not said publicly in the sources reviewed whether it notified the victims or whether they have removed the intruders. (CrowdStrike)

No DeepSeek statement on this report was found on its home page or API news page, or in web searches, as of November 2, 2026, UTC. NBC's gated article may address this. DeepSeek did not respond to Bloomberg on the TeamT5 story in August. The second model's provider is unidentified, so the record could not check for a provider-specific response. (Bloomberg via Deccan Chronicle)

ARTEX's developer said in an October 8 statement, nine days before the reported campaign began, that attacks using the tool had nothing to do with its author, condemned unauthorized use and ended public releases. The translation is ours. That step did not remove existing copies, according to Google. (Autumn-27 statement; Google)

No named-victim response could be checked because CrowdStrike named no victim. Web searches, including Greek and Spanish terms, found no statement from a Greek government body, a Latin American foreign ministry, a Middle Eastern interior ministry, a telecommunications provider or a pharmaceutical company about this report. An absence in these searches does not show that none exists.