# CrowdStrike Ties VAPOR PANDA to AI Campaign Targeting More Than 200 Organizations By Simon Yoon Canonical URL: https://www.tokenpost.com/news/technology/45223 Published: 2026-10-30T23:01:15.000Z Updated: 2026-10-30T23:01:15.000Z Section: Technology > The campaign began Oct. 17 and ran over an 11-day window, with post-exploitation activity confirmed at nine organizations. CrowdStrike attributed an AI-assisted campaign targeting more than 200 organizations in at least 14 countries to VAPOR PANDA, with post-exploitation activity confirmed at nine organizations. The campaign began Oct. 17 and ran over an 11-day window. The figure counts distinct organizations targeted, not confirmed compromises. A separate engagement targeted 19 U.S.-based organizations in the pharmaceutical, semiconductor, defense, nuclear and financial sectors. Telecommunications providers in the United States, Belgium and the Philippines were also compromised, and foreign ministries were among the targets. At the nine organizations with confirmed post-exploitation activity, recorded actions included access, deployment of the BLOODALCHEMY backdoor, credential spraying, network scanning and reconnaissance. At least 12 additional organizations showed password-spraying and credential-scanning activity. The total above 200 describes the campaign’s reach, not a count of confirmed breaches. ARTEX is an AI-assisted penetration-testing framework that coordinates a main agent with planner and worker agents. The agents share findings and pursue attack paths in parallel. VAPOR PANDA primarily used DeepSeek and an unidentified subscription-based commercial large language model. During one intrusion, planning agents consumed about 1.4 billion input tokens; that figure covers one intrusion, not the entire campaign. Recovered transcripts showed a human operator giving instructions in Chinese and steering the agents at decision points. The activity involved simultaneous engagements under human direction, rather than fully autonomous operations. The VAPOR PANDA campaign was separate from Storm-0940’s ARTEX activity. Microsoft described Storm-0940 as China-state-aligned. The group used ARTEX as early as September 2026 in activity targeting hundreds of organizations. In several cases, the group gained privileged cloud access in less than three hours from initial targeting. Zscaler linked ARTEX use to attacks on South Korean financial firms involving personal information belonging to about 67,000 people. Zscaler assessed the operator as financially motivated and Chinese-speaking with moderate confidence. The campaigns were distinct, with no shared command structure established among ARTEX users. TokenPost has also covered [Microsoft’s findings on AI use by North Korean-linked hacking groups](). ## Links in this article - [Microsoft’s findings on AI use by North Korean-linked hacking groups](https://www.tokenpost.com/news/technology/44318)