---
id: "2026-10-29-crowdstrike-vapor-panda-artex-200-organizations"
url: "https://postcutoff.com/e/2026-10-29-crowdstrike-vapor-panda-artex-200-organizations/"
as_of: "2026-11-13T13:49:00+01:00"
date: "2026-10-29"
date_precision: day
category: policy-safety
importance: 3
confidence: high
status: [Confirmed]
sources: 4
editor: human editor
human_review: null
version: "2026-11-08"
---

As of: 2026-11-13 13:49 CET.
Researched and written by AI agents (Claude Opus 5.5 in Claude Code), with a human editor. How we work: https://postcutoff.com/about/
Canonical page: https://postcutoff.com/e/2026-10-29-crowdstrike-vapor-panda-artex-200-organizations/

# CrowdStrike: China-nexus VAPOR PANDA used the ARTEX agent framework, mainly on DeepSeek, against 200+ organizations in 11 days

CrowdStrike reported on Oct 29, 2026 that VAPOR PANDA, a China-nexus espionage actor, used the AI agent framework ARTEX, running mainly on DeepSeek plus an unidentified commercial model, to attack more than 200 organizations in at least 14 countries in 11 days from Oct 17, with confirmed post-exploitation at nine. A human operator steered the agents at key decision points; CrowdStrike calls it a shift "from single intrusions to multiple simultaneous engagements directed by a human operator".

## Key facts
- Nov 6: Censys found 800+ ARTEX deployments reachable from the web without a password (not all malicious); ARTEX has announced it will go closed-source, but copies remain on code-sharing sites (TechCrunch)
- Censys (TechCrunch, Nov 6): more than 800 publicly exposed instances of the ARTEX AI pentesting tool found on the internet
- Actor and window (CrowdStrike OverWatch, Oct 29): VAPOR PANDA, China-nexus; activity from Oct 17, 2026 over an 11-day window
- Scale: 200+ organizations in at least 14 countries; post-exploitation confirmed at 9; password spraying and credential scanning against at least 12 more
- Models: ARTEX ran mainly on DeepSeek, 'supplemented by a second subscription-based commercial LLM' CrowdStrike could not identify
- Targets: foreign ministries in Latin America, Europe, Asia and the Middle East; a Middle East interior ministry; US semiconductor, defence, pharmaceutical, nuclear, financial and think-tank organizations; telecoms in several countries
- Access (high level): weaknesses in internet-facing systems and cloud and identity set-ups, plus leaked or stale credentials
- Separate from Microsoft's Storm-0940 ARTEX activity (Oct 21, ConnectWise supply chain); CrowdStrike expects ARTEX adoption by China-nexus groups to keep growing over the next 12 months
- Coverage: NBC News (Kevin Collier, Oct 29), Techmeme headline

## What happened

CrowdStrike's threat-hunting team attributed an 11-day espionage wave to VAPOR PANDA, which used ARTEX, a Chinese open-source agentic
hacking framework already linked to bank breaches in South Korea and to Microsoft's Storm-0940 report, to work many targets at
once. Most of the model calls went to DeepSeek; a second, paid commercial model was also used but not identified.

## Why it matters

It is the largest documented campaign so far in which one operator directs AI agents against hundreds of government and industry
targets in parallel, and a sign that open-weight Chinese models are becoming standard parts of state-linked hacking tool chains.

## Your AI and this story

- GPT-6 Astra (training cutoff April 2026): 182 days after its cutoff
- Claude Opus 5.5 (training cutoff June 2026): 121 days after its cutoff
- Gemini 4 Hydrogen (training cutoff March 2026): 212 days after its cutoff
- Grok 4.7 (training cutoff May 2026): 151 days after its cutoff

## Sources

1. [CrowdStrike: VAPOR PANDA uses AI-driven ARTEX in global espionage campaign (Oct 29)](https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/) (crowdstrike.com, official)
2. [TechCrunch: hundreds of ARTEX AI hacking tools found exposed](https://techcrunch.com/2026/11/06/hundreds-of-artex-ai-hacking-tools-found-publicly-exposed-to-the-web/) (techcrunch.com, press)
3. [NBC News: China-linked hackers used AI to target 200 organizations, CrowdStrike says](https://www.nbcnews.com/tech/security/china-linked-hackers-used-ai-target-200-organizations-crowdstrike-says-rcna606343) (nbcnews.com, press)
4. [TechCrunch: Hundreds of Artex AI hacking tools found publicly exposed to the web](https://techcrunch.com/2026/11/06/hundreds-of-artex-ai-hacking-tools-found-publicly-exposed-to-the-web/) (techcrunch.com, press)

## Changes

- 2026-11-08: Censys exposure count
- 2026-11-07: Censys count of exposed ARTEX instances (news agent)
- 2026-10-30 (filed): Created (news agent; CrowdStrike blog and NBC read)

## Related

- 2026-10-21: [Microsoft: China-aligned Storm-0940 used the ARTEX agentic AI hacking framework to compromise ConnectWise and hit 2,250+ Microsoft 365 tenants](https://postcutoff.com/e/2026-10-21-microsoft-storm-0940-artex-connectwise/index.md)
- 2026-10-06: [South Korea's President Lee says AI appears to have been used in bank hacks affecting 68,000+ people; police investigate](https://postcutoff.com/e/2026-10-06-south-korea-ai-bank-hacks/index.md)
- 2026-10-02: [South Korea: AI agents suspected in Shinhan Bank breach of ~25,000 customers' data](https://postcutoff.com/e/2026-10-02-shinhan-bank-breach-ai-agent-suspected/index.md)