Starting October 17, 2026, a China-based "targeted intrusion adversary" tracked by CrowdStrike as Vapor Panda used an AI tool against more than 200 distinct organizations worldwide.
Vapor Panda's October 17, 2026 ARTEX campaign
CrowdStrike attributes a broad, concurrent campaign beginning October 17, 2026 to a China-based actor it calls Vapor Panda (previously VexatiousTemper). The firm reports the adversary used a Go-based, AI-powered penetration testing framework called ARTEX to strike "more than 200 distinct organizations" across regions and sectors, targeting foreign ministries in Latin America, Europe, Asia and a Middle East interior ministry; defense, finance, justice and intelligence entities in a European country including that nation's presidency and prime minister's office; 19 U.S.-based organizations in pharmaceutical, semiconductor, defense, nuclear and financial sectors; and telecommunications providers in the U.S., Belgium, and the Philippines.
ARTEX, DeepSeek, and a commercial LLM
The operation centered on ARTEX used in combination with DeepSeek and "an as-yet-unknown, subscription-based commercial large language model (LLM)." CrowdStrike described ARTEX-driven operations as agentic and highly parallelized: "Agentic tooling like ARTEX enables this scale of expansion at speed, allowing a small team to pursue a wider target set than manual operations would support, rather than a wholesale shift away from the adversary's established access-development mission." ARTEX's developer, Li Puhua (alias "Autumn-27"), recently moved the project closed source after rapid adoption by multiple threat actors, according to the reporting.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleHow the agents worked: planners, workers, and token scale
CrowdStrike's analysis shows ARTEX orchestrating an army of planner and worker agents that coordinate to move from initial access to host reconnaissance and lateral movement, with a human operator "in the loop" to steer objectives. In one intrusion, the planning agents alone "consumed on the order of 1.4 billion input tokens," a figure the vendor cites to indicate the scale of automated activity across the operation.
Recovered transcripts and workflows show agents instructed to write web shells, extract domain administrator passwords, and enumerate endpoint sensor coverage. The agents pursued multiple attack paths in parallel and shifted approaches when a path failed, spanning web applications, cloud services, container environments, Active Directory, and mail and VPN infrastructure.
Post-exploitation and techniques observed
CrowdStrike confirmed post-exploitation activity at nine organizations where the adversary deployed BLOODALCHEMY, described as a derivative of ShadowPad, followed by credential spraying, network scanning, and reconnaissance. The report also documents password-spraying and credential-scanning against at least 12 additional organizations, including U.S.-based think tanks and government entities in Europe.
- Cloud and metadata exploitation: agents chained an unsigned SAML assertion and an XML external entity (XXE) flaw to query the cloud Instance Metadata Service, obtain a role capable of issuing administrative commands across thousands of instances, and escalate to recover an enterprise administrator account.
- Container and orchestration abuse: agents deployed web shells and abused an unauthenticated orchestration service to obtain root access in a production container environment, read LAPS passwords, and leverage resource-based constrained delegation to impersonate privileged accounts.
- Key reuse and VPN pivoting: agents were supplied authentication keys unchanged since 2022 to forge administrator tokens and read mailboxes; recovered VPN configurations and a VPN client key tied to a purported May 2024 email leak were used to reach internal networks.
Other Panda clusters: FlowCloud, IceGiant, and targeted specialties
The disclosure arrives alongside CrowdStrike's naming of four previously undocumented China-linked groups — Hollow Panda, Overcast Panda, Titan Panda, and Veiled Panda — each with distinct tools and targeting. Overcast Panda has been linked to close-access intrusions where the adversary deployed a proprietary FlowCloud backdoor via DLL sideloading; CrowdStrike said, "FlowCloud itself is a sophisticated, purpose-built tool uniquely associated with Overcast Panda." Once deployed, FlowCloud provides persistent access enabling keylogging, screen capture, file collection, and credential harvesting.
Titan Panda has exploited a hard-coded IIS machine key vulnerability in Intapp Time Server to achieve remote code execution at law firms, deploying an in-memory framework called IceGiant for reconnaissance, persistence, lateral movement, and data exfiltration. CrowdStrike assesses Titan Panda has operated since at least 2021 and compromised legal organizations in North America for over two years.
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams: Rapid, agentic orchestration like ARTEX multiplies the number of parallel attack paths a small operator can pursue; teams will need to watch for novel LLM-assisted tooling orchestrating reconnaissance, exploitation, and post-exploitation at scale.
- Policymakers and regulators: The use of subscription-based commercial LLMs and cross-border targeting of foreign ministries, executive offices, and critical sectors highlights transnational dimensions that may inform dialogues about attribution, supply chain risk, and the governance of powerful automation tools.
- Affected enterprises and procurement leaders: The campaign underscores the risk posed by long-lived keys, unrotated credentials, unauthenticated orchestration endpoints, and default or hard-coded application keys referenced in the report; those specific failure points were actively exploited by the agents in multiple engagements.
The record delivered by CrowdStrike shows a familiar adversary profile — small human teams enabled by powerful automation, using both novel agentic frameworks and established exploitation techniques. That combination, the vendor warns, lets one operator apply a wider range of techniques against more targets than manual operations would permit. For defenders, the concrete artifacts named in the report — ARTEX, DeepSeek, BLOODALCHEMY, FlowCloud, IceGiant, and the token and key reuse patterns — provide immediate technical leads to hunt and harden against as the incident response community digests the campaign.
