CrowdStrike reports that VAPOR PANDA used ARTEX with DeepSeek and an unidentified commercial model to run parallel intrusions under human direction. It distinguishes more than 200 targeted organizations from nine with confirmed post-exploitation activity, and separates this campaign from Storm-0940.
Why it matters
It adds investigative evidence of parallel agent-assisted espionage while distinguishing targeting, compromise and operator control.
Key facts
As stated in the sources, with where to find them.
- CrowdStrike describes activity beginning October 17 across at least 14 countries over an 11-day observation window; the target count is not a count of successful breaches.Targeting
- Recovered tooling and transcripts showed human instructions at decision points. CrowdStrike identifies DeepSeek but could not confirm the second commercial model.Inside the Operation
- The nine confirmed organizations had post-exploitation activity including backdoor deployment and reconnaissance. Attribution and compromise findings are CrowdStrike assessments, without independent victim confirmations in this source.Targeting; Details
Findings that cite this record
Aug 27, 2025
Oct 22, 2026
Key questions this bears on
- How are attackers using AI agents in real operations?To run parts of intrusions at scale: vendors report a state-aligned actor and criminal groups using open-source agent frameworks and commercial models.
Sources
Related records
Oct 7, 2026
Oct 29, 2026
Oct 21, 2026
Oct 21, 2026
Oct 29, 2026
Sep 30, 2026