CrowdStrike has reported that the Chinese group Vapor Panda launched a campaign targeting over 200 organizations across at least 14 countries starting on October 17, 2026. The group utilized the AI penetration-testing framework ARTEX, developed in China, to automate reconnaissance, vulnerability identification, and exploitation.
The campaign's targets included foreign ministries, telecommunications providers, and organizations in sectors such as pharmaceuticals, semiconductors, defense, and finance. The countries affected include the United States, Belgium, and the Philippines. CrowdStrike confirmed post-exploitation activities at nine organizations, including the use of the BLOODALCHEMY backdoor.
The group employed DeepSeek and an unknown commercial AI system to conduct these intrusions at scale. Approximately 70% of the targets were confirmed compromised or showed evidence indicating moderate confidence of a successful intrusion.
The use of ARTEX allowed Vapor Panda to pursue a wider target set than manual operations would typically support. The developer of ARTEX, Li Puhua, took the framework closed source after it spread among threat actors. Vapor Panda has been active since at least February 2021 and is tracked by CrowdStrike as a targeted intrusion adversary.
The campaign is distinct from other ARTEX activity attributed to the group Storm-0940, which targeted ConnectWise customers.