Executive Summary
CrowdStrike has identified a large-scale campaign by the China-nexus actor VAPOR PANDA, utilizing the ARTEX agentic AI framework to automate and scale intrusions across over 200 organizations worldwide. Starting in October 2026, the adversary leveraged the Chinese DeepSeek LLM and additional commercial models to run parallel 'tasks' against high-value targets, including foreign ministries in Latin America, Europe, and Asia, as well as U.S. defense and semiconductor firms.
The technical workflow represents a significant evolution in adversary tradecraft, utilizing AI agents to handle reconnaissance, lateral movement, and even endpoint sensor evasion. VAPOR PANDA human operators provide high-level instructions (in Chinese) while the agents chain complex vulnerabilities, such as SAML/XXE flaws and cloud metadata exploitation, to gain administrative access across multiple environments simultaneously.
This campaign marks a critical turning point where AI-driven tooling enables small adversary teams to bypass the traditional bottleneck of manual operations. Affected sectors face a heightened risk of rapid credential theft and long-term access development, necessitating advanced EDR coverage and strict identity management policies.