AI agents ran a China-linked hacking campaign against 200 organisations, CrowdStrike says

CrowdStrike says a China-linked hacking group used AI agents to target more than 200 organisations in at least 14 countries in just 11 days. The group, VAPOR PANDA, attacked from 17 October, using an AI tool called ARTEX with the DeepSeek AI model and a second model CrowdStrike could not identify. CrowdStrike published its findings on Thursday, 29 October.

The AI did much of the work. ARTEX uses a main agent that gives jobs to “planner” and “worker” agents, which share what they find. One human operator steered several break-ins at once, stepping in only at key points and giving orders in Chinese. In one break-in alone, the planning agents used about 1.4 billion input tokens.

The targets were high-value: foreign ministries in Latin America, Europe, Asia and the Middle East, an interior ministry in the Middle East, 19 organisations in the United States in the medicines, computer-chip, defence, nuclear and finance sectors, and telecom providers in the United States, Belgium and the Philippines. CrowdStrike confirmed break-ins at nine organisations, where the attackers installed a backdoor called BLOODALCHEMY and tried to steal passwords and map the networks. At least 12 more faced attacks that tried common passwords against many accounts.

The speed is what stands out. Adam Meyers, a senior CrowdStrike executive, told CyberScoop that a person typing by hand typically manages up to 40 commands an hour, while ARTEX could run more than 1,500 an hour. CyberScoop reported on 31 October that the campaign was still active. CrowdStrike said this was the first time it had seen VAPOR PANDA use AI tools.

Why it matters

The campaign shows AI can let a small hacking team attack many targets at once, far faster than any human team. CrowdStrike said the attackers built their system largely from public tools and commercial AI models, so other groups could copy it. It is separate from a different ARTEX campaign Microsoft linked to a group called Storm-0940, suggesting the same tool is spreading.

What happens next

CrowdStrike expects China-linked groups to keep using AI agent tools like ARTEX over the next 12 months. It advised organisations to change passwords and security keys after any suspected exposure, patch internet-facing systems, and use endpoint-detection software on every server.

This article is for general information and education only. It is not legal or financial advice.

Sources

• https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/ (CrowdStrike, 29 October 2026)
• http://thehackernews.com/2026/10/chinese-hackers-use-ai-powered-artex-to.html (The Hacker News, 30 October 2026)
• https://www.europesays.com/3343177/ (CyberScoop, 31 October 2026)