conv.

All stories
SecurityQuiet 8d · day 13

CrowdStrike exposes VAPOR PANDA's AI-driven espionage campaign hitting 200+ orgs

Chinese-nexus hackers used the ARTEX agent framework with DeepSeek and a second LLM to run parallel intrusions worldwide.

newest coverage 8d agosummary written 12d ago4 pieces8 likes & upvotes NewswiresXHacker NewsMastodon

What to know

  • CrowdStrike says VAPOR PANDA used the AI-driven ARTEX agentic framework with DeepSeek and a second commercial LLM to run parallel intrusions against 200+ organizations in 14+ countries starting October 17, 2026.
  • Targets spanned foreign ministries, an interior ministry, a European presidency and prime minister's office, 19 U.S. defense/semiconductor/pharma/nuclear/financial firms, and telecoms in the U.S., Belgium and the Philippines.
  • Post-exploitation access with the BLOODALCHEMY backdoor was confirmed at nine organizations, with password-spraying against at least 12 more.
  • CrowdStrike distinguishes this campaign from previously reported Storm-0940-linked ARTEX activity, noting the adversary also built evasion of CrowdStrike's own sensor into its AI workflow.

VAPOR PANDA China-nexus espionage actorCrowdStrike OverWatch Threat hunting unit that discovered and disclosed the campaignDeepSeek Chinese-origin LLM used by the attackers

CrowdStrike exposes VAPOR PANDA's AI-driven espionage campaign hitting 200+ orgs
x.com

How it unfolded 1 development · click the chart to see its coverage articlesposts

Peak 2 pieces in 3h at Oct 29, 11 PM; 4 pieces over 13 days (1 article · 3 posts) Oct 29, 11 PM — 2 pieces · 1 article · 1 post — Newswires 1, X 1Oct 30, 2 AM — quietOct 30, 5 AM — quietOct 30, 8 AM — quietOct 30, 11 AM — 1 piece · 1 post — Hacker News 1Oct 30, 2 PM — quietOct 30, 5 PM — quietOct 30, 8 PM — quietOct 30, 11 PM — quietOct 31, 2 AM — quietOct 31, 5 AM — quietOct 31, 8 AM — quietOct 31, 11 AM — quietOct 31, 2 PM — quietOct 31, 5 PM — quietOct 31, 8 PM — quietOct 31, 11 PM — quietNov 1, 1 AM — quietNov 1, 4 AM — quietNov 1, 7 AM — quietNov 1, 10 AM — quietNov 1, 1 PM — quietNov 1, 4 PM — quietNov 1, 7 PM — quietNov 1, 10 PM — quietNov 2, 1 AM — quietNov 2, 4 AM — quietNov 2, 7 AM — quietNov 2, 10 AM — quietNov 2, 1 PM — quietNov 2, 4 PM — quietNov 2, 7 PM — quietNov 2, 10 PM — quietNov 3, 1 AM — quietNov 3, 4 AM — quietNov 3, 7 AM — quietNov 3, 10 AM — 1 piece · 1 post — Mastodon 1Nov 3, 1 PM — quietNov 3, 4 PM — quietNov 3, 7 PM — quietNov 3, 10 PM — quietNov 4, 1 AM — quietNov 4, 4 AM — quietNov 4, 7 AM — quietNov 4, 10 AM — quietNov 4, 1 PM — quietNov 4, 4 PM — quietNov 4, 7 PM — quietNov 4, 10 PM — quietNov 5, 1 AM — quietNov 5, 4 AM — quietNov 5, 7 AM — quietNov 5, 10 AM — quietNov 5, 1 PM — quietNov 5, 4 PM — quietNov 5, 7 PM — quietNov 5, 10 PM — quietNov 6, 1 AM — quietNov 6, 4 AM — quietNov 6, 7 AM — quietNov 6, 10 AM — quietNov 6, 1 PM — quietNov 6, 4 PM — quietNov 6, 7 PM — quietNov 6, 10 PM — quietNov 7, 1 AM — quietNov 7, 4 AM — quietNov 7, 7 AM — quietNov 7, 10 AM — quietNov 7, 1 PM — quietNov 7, 4 PM — quietNov 7, 7 PM — quietNov 7, 10 PM — quietNov 8, 1 AM — quietNov 8, 4 AM — quietNov 8, 7 AM — quietNov 8, 10 AM — quietNov 8, 1 PM — quietNov 8, 4 PM — quietNov 8, 7 PM — quietNov 8, 10 PM — quietNov 9, 1 AM — quietNov 9, 4 AM — quietNov 9, 7 AM — quietNov 9, 10 AM — quietNov 9, 1 PM — quietNov 9, 4 PM — quietNov 9, 7 PM — quietNov 9, 10 PM — quietYesterday, 1 AM — quietYesterday, 4 AM — quietYesterday, 7 AM — quietYesterday, 10 AM — quietYesterday, 1 PM — quietYesterday, 4 PM — quietYesterday, 7 PM — quietYesterday, 10 PM — quietToday, 1 AM — quietToday, 4 AM — quietToday, 7 AM — quietToday, 10 AM — quietToday, 1 PM — quietToday, 4 PM — quiet 1
Oct 30Oct 31Nov 1Nov 2Nov 3Nov 4Nov 5Nov 6Nov 7Nov 8Nov 9yesterdaynow · 7:41 PM ET
  1. 1

    Security researcher amplifies the CrowdStrike findings on X

    A cybersecurity-focused account summarized the campaign's scale and AI tooling shortly after CrowdStrike's disclosure.

    “VAPOR PANDA used ARTEX and AI models to conduct simultaneous espionage intrusions against more than 200 organizations worldwide, deploying BLOODALCHEMY and checking for unprotected hosts.”
    — @cyber_o51nt
    • sawaba@infosec.exchange

      Unfortunately, it looks like political BS is infecting threat reports now. This morning a journalist asked my opinion on this attack campaign, referencing a Crowdstrike writeup: https://www. crowdstrike.com/en-us/blog/vap or-panda-uses-artex-to-scale-global-campaign/ The first paragraph already had my eyebrows comically high (emphasis mine)…

      sawaba@infosec.exchangeMastodon8d ago5▲view on Mastodon ↗
    1 more of the top 2 · 2 posts in this stretch

    • VAPOR PANDA used ARTEX and AI models to conduct simultaneous espionage intrusions against more than 200 organizations worldwide, deploying BLOODALCHEMY and checking for unprotected hosts. https://www.crowdstrike.com/ ...

      @cyber_o51ntX12d agoview on X ↗
    all of them →
  2. background

    CrowdStrike publishes VAPOR PANDA blog detailing ARTEX campaign — CrowdStrike's blog post lays out the full scope of the campaign, notes it is distinct from the Storm-0940-linked ARTEX activity reported elsewhere, and discloses telemetry showing BLOODALCHEMY and its C2 infrastructure not previously public.

  3. background

    CrowdStrike confirms post-exploitation activity at nine organizations — CrowdStrike Intelligence verified the adversary gained access and deployed the BLOODALCHEMY backdoor at nine organizations, followed by credential spraying, network scanning and reconnaissance, plus password-spraying against at least 12 more targets.

  4. background

    Attackers target foreign ministries, defense and telecom firms globally — VAPOR PANDA compromised foreign ministries in Latin America and the Middle East, a European country's presidency and ministries, 19 U.S. organizations in pharma, semiconductor, defense, nuclear and finance sectors, and telecom providers in the U.S., Belgium and the Philippines.

  5. background

    VAPOR PANDA begins mass ARTEX-driven intrusion campaign — A single ARTEX controller linked to VAPOR PANDA started exploitation activity against entities in at least 14 countries, running multiple simultaneous intrusions directed by one human operator.

What people are saying 0 voices from 0 sites · best of 2 · verbatim