Observed incident

CrowdStrike reports VAPOR PANDA using ARTEX across simultaneous intrusions

Reported

Published here

What happened

CrowdStrike observed over 200 organizations targeted across at least 14 countries and confirmed post-exploitation activity at nine. ARTEX coordinated parallel intrusion tasks under human direction.

Parties and reporting

AI tools and systems: ARTEX, DeepSeek, Second commercial LLM, not identified, BLOODALCHEMY

Outcome

Confirmed activity included access, backdoor deployment and follow-on reconnaissance. Complete containment and total losses are not disclosed.

Operating lesson

Rotate exposed historical signing and service keys; validate identity assertions, limit cloud execution roles and close endpoint-monitoring gaps.

Evidence and limits

Activity began October 17; the public report is October 29. Target counts and additional spraying attempts are not compromise counts. China-nexus attribution is CrowdStrike’s assessment. The report explicitly distinguishes this campaign from Storm-0940/ConnectWise.

Sources