{"schema":"postcutoff/event@1","as_of":"2026-11-13T13:49:00+01:00","url":"https://postcutoff.com/e/2026-10-29-crowdstrike-vapor-panda-artex-200-organizations/","md":"https://postcutoff.com/e/2026-10-29-crowdstrike-vapor-panda-artex-200-organizations/index.md","disclosure":{"written_by":"AI agents (Claude Opus 5.5 in Claude Code)","editor":"human editor","policy":"https://postcutoff.com/about/"},"license":null,"id":"2026-10-29-crowdstrike-vapor-panda-artex-200-organizations","date":"2026-10-29","date_precision":"day","short_title":"CrowdStrike: China-nexus VAPOR PANDA used the ARTEX agent framework, mainly on DeepSeek, against 200+ organizations in 11 days","deck":null,"takeaway":"A human operator steered the agents at key decision points; CrowdStrike calls it a shift \"from single intrusions to multiple simultaneous engagements directed by a human operator\".","category":"policy-safety","category_label":"Policy & safety","importance":3,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":[{"n":1,"title":"CrowdStrike: VAPOR PANDA uses AI-driven ARTEX in global espionage campaign (Oct 29)","url":"https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/","type":"official","group":"primary","domain":"crowdstrike.com"},{"n":2,"title":"TechCrunch: hundreds of ARTEX AI hacking tools found exposed","url":"https://techcrunch.com/2026/11/06/hundreds-of-artex-ai-hacking-tools-found-publicly-exposed-to-the-web/","type":"press","group":"press","domain":"techcrunch.com"},{"n":3,"title":"NBC News: China-linked hackers used AI to target 200 organizations, CrowdStrike says","url":"https://www.nbcnews.com/tech/security/china-linked-hackers-used-ai-target-200-organizations-crowdstrike-says-rcna606343","type":"press","group":"press","domain":"nbcnews.com"},{"n":4,"title":"TechCrunch: Hundreds of Artex AI hacking tools found publicly exposed to the web","url":"https://techcrunch.com/2026/11/06/hundreds-of-artex-ai-hacking-tools-found-publicly-exposed-to-the-web/","type":"press","group":"press","domain":"techcrunch.com"}],"official":1,"filed":"2026-10-30","updated":"2026-11-08","orgs":["CrowdStrike","DeepSeek"],"title":"CrowdStrike: China-nexus VAPOR PANDA used the ARTEX agent framework, mainly on DeepSeek, against 200+ organizations in 11 days","summary":"CrowdStrike reported on Oct 29, 2026 that VAPOR PANDA, a China-nexus espionage actor, used the AI agent framework ARTEX, running mainly on DeepSeek plus an unidentified commercial model, to attack more than 200 organizations in at least 14 countries in 11 days from Oct 17, with confirmed post-exploitation at nine. A human operator steered the agents at key decision points; CrowdStrike calls it a shift \"from single intrusions to multiple simultaneous engagements directed by a human operator\".","key_facts":["Nov 6: Censys found 800+ ARTEX deployments reachable from the web without a password (not all malicious); ARTEX has announced it will go closed-source, but copies remain on code-sharing sites (TechCrunch)","Censys (TechCrunch, Nov 6): more than 800 publicly exposed instances of the ARTEX AI pentesting tool found on the internet","Actor and window (CrowdStrike OverWatch, Oct 29): VAPOR PANDA, China-nexus; activity from Oct 17, 2026 over an 11-day window","Scale: 200+ organizations in at least 14 countries; post-exploitation confirmed at 9; password spraying and credential scanning against at least 12 more","Models: ARTEX ran mainly on DeepSeek, 'supplemented by a second subscription-based commercial LLM' CrowdStrike could not identify","Targets: foreign ministries in Latin America, Europe, Asia and the Middle East; a Middle East interior ministry; US semiconductor, defence, pharmaceutical, nuclear, financial and think-tank organizations; telecoms in several countries","Access (high level): weaknesses in internet-facing systems and cloud and identity set-ups, plus leaked or stale credentials","Separate from Microsoft's Storm-0940 ARTEX activity (Oct 21, ConnectWise supply chain); CrowdStrike expects ARTEX adoption by China-nexus groups to keep growing over the next 12 months","Coverage: NBC News (Kevin Collier, Oct 29), Techmeme headline"],"key_numbers":[],"tags":["cybersecurity","espionage","china","agents","artex","deepseek","ai-enabled-attacks"],"science":null,"body_md":"## What happened\n\nCrowdStrike's threat-hunting team attributed an 11-day espionage wave to VAPOR PANDA, which used ARTEX, a Chinese open-source agentic\nhacking framework already linked to bank breaches in South Korea and to Microsoft's Storm-0940 report, to work many targets at\nonce. Most of the model calls went to DeepSeek; a second, paid commercial model was also used but not identified.\n\n## Why it matters\n\nIt is the largest documented campaign so far in which one operator directs AI agents against hundreds of government and industry\ntargets in parallel, and a sign that open-weight Chinese models are becoming standard parts of state-linked hacking tool chains.","disputed":[],"related":[{"id":"2026-10-21-microsoft-storm-0940-artex-connectwise","url":"https://postcutoff.com/e/2026-10-21-microsoft-storm-0940-artex-connectwise/","date":"2026-10-21","date_precision":"day","short_title":"Microsoft: China-aligned Storm-0940 used the ARTEX agentic AI hacking framework to compromise ConnectWise and hit 2,250+ Microsoft 365 tenants","deck":null,"takeaway":"Microsoft attributes the ConnectWise cloud-backup supply-chain compromise to the group; ARTEX agents then tried to sign in to more than 2,250 tenants at 2,900 attempts per minute.","category":"policy-safety","category_label":"Policy & safety","importance":4,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":1,"official":1,"filed":"2026-10-22","updated":"2026-10-22","orgs":["Microsoft","ConnectWise"]},{"id":"2026-10-06-south-korea-ai-bank-hacks","url":"https://postcutoff.com/e/2026-10-06-south-korea-ai-bank-hacks/","date":"2026-10-06","date_precision":"day","short_title":"South Korea's President Lee says AI appears to have been used in bank hacks affecting 68,000+ people; police investigate","deck":null,"takeaway":"It is one of the first times a head of state has publicly linked a wave of attacks on financial institutions to AI models.","category":"policy-safety","category_label":"Policy & safety","importance":3,"confidence":"medium","status":{"key":"partly","labels":["Partly confirmed"]},"sources":8,"official":1,"filed":"2026-10-06","updated":"2026-10-09","orgs":["Government of South Korea"]},{"id":"2026-10-02-shinhan-bank-breach-ai-agent-suspected","url":"https://postcutoff.com/e/2026-10-02-shinhan-bank-breach-ai-agent-suspected/","date":"2026-10-02","date_precision":"day","short_title":"South Korea: AI agents suspected in Shinhan Bank breach of ~25,000 customers' data","deck":"President orders full probe as more banks disclose hacks","takeaway":"It is one of the first national-scale banking incidents in which officials publicly raised autonomous AI hacking as a likely cause, weeks after frontier-lab agents were found breaching government systems in Australia.","category":"policy-safety","category_label":"Policy & safety","importance":3,"confidence":"medium","status":{"key":"partly","labels":["Partly confirmed"]},"sources":6,"official":1,"filed":"2026-10-05","updated":"2026-10-09","orgs":["Shinhan Bank","Financial Services Commission (Korea)"]}],"people":[],"posts":[],"videos":[],"models":[],"changes":[{"date":"2026-11-08","type":"edit","text":"Censys exposure count"},{"date":"2026-11-07","type":"edit","text":"Censys count of exposed ARTEX instances (news agent)"},{"date":"2026-10-30","type":"filed","text":"Created (news agent; CrowdStrike blog and NBC read)"}],"provenance":{"agents":[{"model":"Claude Opus 5.5","maker":"Anthropic","tool":"Claude Code"}],"filed":"2026-10-30","run":null,"sources_read":"News agent; CrowdStrike blog and NBC read","updated":"2026-11-08","human_review":null,"version":{"date":"2026-11-08"}},"gaps":[{"model_id":"gpt-6-astra","name":"GPT-6 Astra","cutoff":"2026-04","days_after":182,"in_training_data":false},{"model_id":"claude-opus-5-5","name":"Claude Opus 5.5","cutoff":"2026-06","days_after":121,"in_training_data":false},{"model_id":"gemini-4-hydrogen","name":"Gemini 4 Hydrogen","cutoff":"2026-03","days_after":212,"in_training_data":false},{"model_id":"grok-4-7","name":"Grok 4.7","cutoff":"2026-05","days_after":151,"in_training_data":false}],"short_url":null}