.jpg){kind=link}
CrowdStrike: China-Linked Group Used AI Agents Against Over 200 Organizations in 14 Countries
On October 29, CrowdStrike published a campaign disclosure that the company describes as the first publicly documented use of an AI agent framework at this scale inside a state-sponsored offensive operation: a single China-linked operator, tracked as VAPOR PANDA, allegedly directed AI-driven attacks against over 200 organizations in at least 14 countries over 11 days. But behind the headlines, the picture is more nuanced — and more instructive — than "autonomous AI agents": the transcripts show human steering at every decision point, and most of the targets were never compromised.
Core Facts — and What Is Claimed
CrowdStrike's findings, published October 29, 2026, attribute to the group VAPOR PANDA — tracked by Trend Micro as Earth Estries — a campaign in which a single ARTEX controller was directed at entities in at least 14 countries in an 11-day window beginning October 17. NBC News has covered the report's core numbers, but no independent party has verified the company's findings; Forkast, which covered the report, explicitly states that the company has not itself confirmed the incident.
The most important distinction in the report is between targeting and compromise. The 200+ organizations describe reported targeting — not confirmed intrusions. CrowdStrike reports confirmed post-exploitation at nine organizations, where the BLOODALCHEMY backdoor (previously documented by Elastic Security Labs in October 2023) was deployed, and credential spraying or scanning against at least 12 more. The company does not specify how the nine relate to the universe of 200+ targets, and consequently no success rate can be calculated.
CrowdStrike bases its account on its own telemetry data, exposed controller tooling, target files, and recovered transcripts.
What "Agent-Based" Actually Means Here
The recovered transcripts contain operator instructions labeled "human instruction" in Chinese, with a human intervening at decision points. CrowdStrike describes this as coordinated software under human direction — not autonomous action, a point Forkast also emphasizes. The picture, then, is not a self-directed AI hacking on its own, but one human orchestrating a hierarchy of software agents across a number of simultaneous targets that would previously have required an entire team.
How ARTEX Works
ARTEX uses a hierarchical orchestrator-planner-worker architecture. All agents in a single operation share a continuously updated knowledge graph — a living map of confirmed facts, discovered credentials, known network topology, and failed approaches. This eliminates duplicated work and means a discovery by one worker agent is immediately available to all others — the precondition for running many parallel attack paths against many simultaneous targets.
The measurements of resource consumption are striking: CrowdStrike measured roughly 1.4 billion input tokens consumed in a single intrusion. The extrapolation of "tens to hundreds of billions" of tokens across the campaign is the publisher's own calculation, not a CrowdStrike figure. DeepSeek was the primary LLM backend, supplemented in some intrusions by another, unidentified commercial model.
Findings Beyond the Campaign — Same Tool, More Actors
Several other vendors documented parallel ARTEX findings in October, showing the tool was used by at least two additional actor clusters alongside VAPOR PANDA — with varying degrees of attribution confidence.
Google Threat Intelligence and Mandiant have observed ARTEX in use since late August 2026, against victims in the public sector, technology, chemicals, manufacturing, and telecom. Their characterization is speed: single bursts of roughly 2–25 seconds, with one case showing 27 events in 23 seconds — according to Cyber Security News' coverage of Google's findings, an operational tempo no human could match. The techniques included Kerberoasting, DCSync, and theft of the krbtgt key, with over 110,000 Active Directory objects exfiltrated in one case.
Microsoft linked the group Storm-0940 to a compromise of ConnectWise Cloud Backup, tracking over 151,000 failed login attempts from October 10 to 14 against 327 accounts at eight companies, with peaks of 2,900 per minute. No successful login was observed.
Zscaler reported a campaign in late September 2026 against South Korean financial institutions, assessed as financially motivated, with moderate confidence that the actors were Chinese-speaking — no state sponsorship has been confirmed. The company states that personal data on roughly 67,000 people was stolen.
In addition, CrowdStrike found Claude Code log files on attacker-controlled systems, a sign that developer tools are also part of attackers' arsenals.
The Tool's Origins
ARTEX began as an open source penetration testing framework written in Go by the Chinese "Autumn-27" — identified by CrowdStrike as Li Puhua. On October 8, he took the code out of open source and published a statement on GitHub warning against malicious use. But copies continue to spread via forks, illustrating the limits of "recalling" a tool that has already proliferated.
On October 26, South Korean police arrested a former pentester in what authorities describe as the country's first arrest connected to a large-scale hacking operation powered by generative AI. Police state that the operation used ARTEX to steal 8.2 million rows from over 90 organizations — a figure that is the police's description and not directly comparable to Zscaler's assessment of roughly 67,000 affected in a (possibly) separate incident.
Open Questions
The most important uncertainties remain real: the relationship between the nine confirmed compromises and the 200+ targets is unspecified, the success rate cannot be calculated, and none of the vendors' publications have been independently verified. The name of the second commercial model has not been disclosed, and there is no confirmation that the ARTEX operations were fully autonomous — quite the opposite.
What This Means for Defenders
The real change documented here is not autonomy, but speed and parallelism: one human directing an agent structure that can keep hundreds of simultaneous attack paths running, share findings instantly across targets, and operate in bursts of seconds where human teams take hours. For defenders, that means the detection gap is no longer about sophisticated zero-days, but about recognizing the volume, speed, and parallelism of agent-driven reconnaissance — before an attacker's knowledge graph becomes complete.
Sources
- CrowdStrike Reports VAPOR PANDA Used ARTEX Against 200+ Organizations (Forkast/Yahoo)
- China hacked 200 organizations in 11 days: One human, AI agents in command (MSN)
- China-linked hackers used AI to target 200 organizations, CrowdStrike says (NBC News)
- Hackers Use ARTEX AI Agents to Automate Active Directory Attacks (Cyber Security News)
- AI-powered hacking goes global as Chinese groups use ARTEX (MSN/Cryptopolitan)