In one intrusion, the AI agents consumed more than 1.4 billion input tokens, a single metric that underlines the scale and automation behind a campaign CrowdStrike says targeted over 200 organizations across 14 countries.
Scope, targets, and immediate outcomes
The operation began on October 17 and — according to CrowdStrike researchers — hit government ministries, telecommunications providers, and organizations in the pharmaceutical, semiconductor, defense, nuclear, and financial sectors. The campaign affected more than 200 organizations across 14 countries; researchers say the threat actor compromised at least nine organizations and carried out password spraying and credential-scanning activity against at least 12 other high-value targets.
CrowdStrike lists confirmed victims that include telecommunications providers in the United States and Belgium, government organizations in Greece, the Middle East, and Latin America, and pharmaceutical firms in the U.S. The company attributes the activity to a tracked actor it calls Vapor Panda.
ARTEX AI, DeepSeek, and the multi-agent playbook
At the center of the campaign was ARTEX AI, described in CrowdStrike’s findings as an open-source, multi-agent AI penetration-testing framework developed by Chinese developers. The tool was initially released as open-source but—per the researchers—its creators later made it proprietary after it was used in real-world attacks, including a campaign targeting South Korean financial institutions.
In the recent operation, Vapor Panda combined ARTEX with DeepSeek and “a second, unidentified commercial language model” to coordinate planning and worker agents and to run multiple intrusions simultaneously. CrowdStrike reports the actors issued instructions in Chinese and intervened at critical decision points, letting agents perform reconnaissance, exploit vulnerabilities, deploy web shells, obtain credentials, and pursue alternative attack paths when needed.
Operators also directed the agents tactically: they “explicitly instructed the agents to skip Windows machines protected by Falcon,” CrowdStrike notes, and to focus on unprotected hosts. In at least one intrusion against a Greek government entity, the AI agents forged an administrator token and read mailboxes by leveraging authentication keys obtained from a 2022 mail-server directory export.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageDIVD case: rapid escalation from access to root
Separately, the Dutch Institute for Vulnerability Disclosure (DIVD) provided more detail about an incident it suffered in September 2026 and attributed to an AI agent. DIVD said the tool used in that attack was ARTEX AI acting autonomously. According to DIVD’s LinkedIn post, the attack moved from initial access to root privileges in 12 minutes by chaining a Zammad zero-day with a second zero-day for local privilege escalation.
DIVD reported that the agent carried out simultaneous tasks — reading a compromised mailbox, scanning the internal network, extracting login tokens, and attempting password resets — while generating over 450,000 requests and running roughly 2,500 scripts. DIVD described the activity as “super loud and messy.”
Use of legacy malware and persistent implants
Beyond ARTEX and associated language models, CrowdStrike found Vapor Panda deploying BLOODALCHEMY, a backdoor that researchers say has been active since 2023, against government entities in Latin America and the Middle East. The combination of a novel multi-agent AI framework and an established backdoor illustrates a blended approach: automated, scalable intrusion tooling layered with persistent implants for follow-on access.
What this means for telecommunications providers, government organizations, and pharmaceutical firms
- Telecommunications providers: Confirmed telecom victims in the U.S. and Belgium should expect investigations to focus on detection of web shells, credential harvesting, and unauthorized mailbox access; the campaign prioritized hosts not protected by Falcon, underscoring the importance of endpoint visibility.
- Government organizations: The Greek interception — where ARTEX agents forged an administrator token using keys from a 2022 directory export — highlights the risk of older credential stores and exported authentication artifacts being reused in attacks.
- Pharmaceutical firms: With pharmaceutical firms in the U.S. among confirmed victims, organizations in sensitive commercial sectors should watch for automated password-spraying and credential-scanning activity that precedes exploitation and persistent implantation.
Escalation: from single intrusions to multiple simultaneous engagements
CrowdStrike characterizes this campaign as “an escalation in China-nexus use of AI agents, from single intrusions to multiple simultaneous engagements directed by a human operator.” The factual record in their report — the coordinated use of ARTEX, DeepSeek, another commercial model, explicit operator instructions in Chinese, the enormous token consumption in at least one intrusion, and the reuse of BLOODALCHEMY implants — supports that assessment: adversaries are combining autonomous agents with human oversight to scale operations across sectors and geographies.
The incidents reported by CrowdStrike and DIVD leave concrete technical signals — forged tokens traced to a 2022 export, heavy token usage metrics, thousands of scripts and hundreds of thousands of requests — that defenders can hunt for. They also raise a narrower, immediate question: when autonomous agents are instructed to avoid specific protections, how will defenders ensure their coverage gaps are not the very pathways adversaries are trained to seek?
