CrowdStrike says a China-nexus espionage group it calls VAPOR PANDA used an AI agent framework to target more than 200 organisations in at least 14 countries over 11 days, starting on 17 October. In a report published on 29 October, the security company said it had confirmed follow-on intrusions at nine organisations, including foreign and interior ministries and telecoms providers in the US, Belgium and the Philippines.
The group used ARTEX, an agentic framework that lets one operator run several intrusions at once, with a human stepping in at key decision points. CrowdStrike says the agents ran mainly on DeepSeek, alongside a second commercial model it could not identify. It calls the campaign “an escalation in China-nexus use of AI agents” and says it is separate from the ARTEX activity reported under the Storm-0940 name earlier this month.
Why it matters: CrowdStrike says earlier cases it tracked involved AI helping with single intrusions, often by financially motivated groups. Here a state-linked spying operation used agents to work at a scale that would normally need a large team. CrowdStrike advises organisations to rotate keys and credentials after any suspected exposure, patch internet-facing appliances and run endpoint detection on every server, not just exposed ones. Read the CrowdStrike report.