CrowdStrike says China-linked VAPOR PANDA used ARTEX AI agents against 200 organizations

CrowdStrike said Oct. 29 that VAPOR PANDA, an espionage group it links to China, used ARTEX, an open-source Chinese-developed framework that runs AI agents through hacking tasks, with the Chinese-developed DeepSeek model and a second commercial model to attack more than 200 organizations from Oct. 17, including foreign ministries in Latin America, Europe, Asia and the Middle East and U.S. semiconductor, defense and think-tank organizations. The company said it confirmed post-exploitation activity at nine organizations, that recovered transcripts show a human operator directing the agents in Chinese, and that the planning agents in one intrusion consumed about 1.4 billion input tokens. Microsoft reported Oct. 21 that a China-aligned actor it tracks as Storm-0940 also used ARTEX against hundreds of organizations and was behind the ConnectWise supply chain compromise; CrowdStrike says the two campaigns are separate.