{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/crowdstrike-vapor-panda-artex-global-campaign-2026/",
 "asOf": "2026-10-30",
 "id": "crowdstrike-vapor-panda-artex-global-campaign-2026",
 "date": "2026-10-29",
 "datePrecision": "day",
 "title": "CrowdStrike reports VAPOR PANDA used ARTEX against more than 200 organizations, with nine confirmed intrusions",
 "lane": "attack",
 "kind": "misuse-report",
 "summary": "CrowdStrike reports that VAPOR PANDA used ARTEX with DeepSeek and an unidentified commercial model to run parallel intrusions under human direction. It distinguishes more than 200 targeted organizations from nine with confirmed post-exploitation activity, and separates this campaign from Storm-0940.",
 "whyItMatters": "It adds investigative evidence of parallel agent-assisted espionage while distinguishing targeting, compromise and operator control.",
 "actors": [
  "crowdstrike",
  "vapor-panda",
  "deepseek"
 ],
 "topics": [
  "ai-enabled-intrusion",
  "autonomous-pentest",
  "multi-agent-security",
  "threat-intelligence"
 ],
 "atlas": [
  "tools",
  "other-agents",
  "credentials"
 ],
 "artifacts": [
  "artex",
  "deepseek"
 ],
 "sources": [
  {
   "url": "https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/",
   "publisher": "CrowdStrike",
   "title": "VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign",
   "date": "2026-10-29",
   "type": "primary",
   "accessed": "2026-10-30"
  }
 ],
 "keyFacts": [
  {
   "fact": "CrowdStrike describes activity beginning October 17 across at least 14 countries over an 11-day observation window; the target count is not a count of successful breaches.",
   "locator": "Targeting"
  },
  {
   "fact": "Recovered tooling and transcripts showed human instructions at decision points. CrowdStrike identifies DeepSeek but could not confirm the second commercial model.",
   "locator": "Inside the Operation"
  },
  {
   "fact": "The nine confirmed organizations had post-exploitation activity including backdoor deployment and reconnaissance. Attribution and compromise findings are CrowdStrike assessments, without independent victim confirmations in this source.",
   "locator": "Targeting; Details"
  }
 ],
 "significance": 4,
 "fideQuestions": [
  "FID-087"
 ],
 "methods": [
  "agent-orchestrated-intrusion"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-10-30",
 "revisions": []
}