Vapor Panda Shows What Human-Directed AI Attacks Look Like
Matthew Leo · Published November 6, 2026 · News
A China-linked threat group used an agentic penetration-testing framework against more than 200 organizations in at least 14 countries over 11 days, according to CrowdStrike. The campaign matters because one operator could pursue many targets in parallel.
It does not prove that an autonomous system independently hacked 200 organizations. CrowdStrike's own evidence describes human instructions, and its public report confirms post-exploitation activity at nine organizations. Targeted, probed and compromised are not interchangeable words.
What CrowdStrike says it observed
CrowdStrike says the group it tracks as Vapor Panda began the campaign on October 17. It used ARTEX with DeepSeek and a second commercial language model to work against foreign ministries, telecommunications providers and organizations in defence, semiconductors, pharmaceuticals, nuclear energy and finance.
The company says it confirmed post-exploitation activity at nine organizations. In those cases, the attackers deployed the BLOODALCHEMY backdoor and conducted credential spraying, network scanning and reconnaissance. CrowdStrike also reported credential-related activity against at least 12 additional organizations.
CyberScoop independently reported the research and interviewed CrowdStrike. It described command rates far above ordinary hands-on-keyboard activity, but the underlying victim and attribution evidence remains CrowdStrike's telemetry and analysis.
The campaign was directed, not unattended
Recovered transcripts included instructions from a human operator. One instruction directed the system to look for Windows machines without CrowdStrike's endpoint sensor.
That detail is important. ARTEX organized planning and execution, tried paths in parallel and shared findings among software workers. A person still selected objectives and intervened at decision points.
The practical risk is therefore not a science-fiction attacker that needs no one. It is a small team gaining the speed and persistence of a much larger operation.
Keep three numbers separate
- More than 200: organizations against which CrowdStrike says ARTEX was directed.
- At least 12: additional organizations where CrowdStrike reported password-spraying or credential-scanning activity.
- Nine: organizations where CrowdStrike says it confirmed post-exploitation activity.
Coverage that collapses these categories into a single success rate overstates the public evidence. CrowdStrike may hold additional private evidence, but readers cannot audit what the company has not published.
Speed changes the defender's window
The tools described in the report still relied on familiar weaknesses: exposed services, stolen credentials, application flaws, weak identity controls and gaps in endpoint coverage. The novelty is the number of attempts and branches an operator can pursue before a defender responds.
Organizations should reduce the value of that speed:
- remove internet exposure that is not required and inventory the services that remain;
- use phishing-resistant authentication and restrict service identities by resource, network and time;
- centralize endpoint, identity, cloud and application logs so one fast campaign does not look like unrelated alerts;
- treat missing security telemetry as an incident signal, not a quiet success;
- rotate credentials and keys after suspected exposure, including secrets in old backups and exports;
- pre-authorize containment actions so responders do not wait for a committee while automation continues.
The Canadian angle is exposure, not confirmed targeting
CrowdStrike says Vapor Panda has historically targeted organizations across North America, but the public campaign report does not name a Canadian victim. Mapletechie is not inferring one.
Canadian telecommunications, defence, energy, research and semiconductor organizations still match the kinds of sectors listed. Their useful response is not to buy a product because one vendor published a dramatic report. It is to check whether identities, exposed systems and incident authority can withstand faster parallel activity.
The campaign also extends Mapletechie's earlier ConnectWise tenant-hunt guide. That incident involved separate ARTEX activity attributed to Storm-0940. CrowdStrike says the Vapor Panda campaign is distinct, which suggests the framework is spreading among more than one operator.
Agentic attack software raises the tempo. It does not erase the need for evidence, human direction or the ordinary controls that stop credentials and exposed services from becoming a path inward.
Tags: Vapor Panda, ARTEX, cybersecurity, AI agents, threat intelligence