cyber.hendryadrian.com
Security News · cyberscoop.com

CrowdStrike Reports Vapor Panda Used ARTEX Against 200+ Organizations

· Original article ↗

Summary

CrowdStrike says China-backed Vapor Panda targeted more than 200 organizations in at least 14 countries, with about 70% confirmed compromised or showing moderate-confidence intrusion evidence. ARTEX and DeepSeek enabled faster, concurrent activity.

Key points

  • CrowdStrike attributes the active campaign to China-backed threat group Vapor Panda and says it began targeting organizations on Oct. 17.
  • Targets included government, defense, intelligence, telecommunications and other organizations in at least 14 countries.
  • CrowdStrike said about 70% of targets were confirmed compromised or had evidence indicating moderate confidence of intrusion.
  • The report says ARTEX, paired with DeepSeek, enabled concurrent attack paths and requests as often as every 10 seconds.
  • CrowdStrike reported ARTEX activity exceeding 1,500 commands per hour, compared with a historical pace of up to 40 hands-on-keyboard commands per hour.
  • CrowdStrike said agentic adversary attacks rose from roughly 45 in September to 126 in October; the article notes the count was still increasing.
  • CrowdStrike recommends organizations maintain visibility into endpoints, identities and cross-domain capabilities.

Article Details

Event Type
Active cyber intrusion campaign using ARTEX, an agentic AI penetration-testing framework, attributed by CrowdStrike to Vapor Panda.
Impact
CrowdStrike reported that Vapor Panda targeted more than 200 organizations in at least 14 countries and compromised about 140 sensitive targets in 11 days. CrowdStrike said about 70% of targets were confirmed compromised or had evidence indicating a moderate-confidence intrusion. Targets included government and defense organizations, intelligence agencies, foreign ministries, and organizations in several commercial sectors.

People

Adam MeyersCrowdStrike’s senior vice president of counter adversary operations; discussed the campaign, ARTEX’s operational speed, and the broader increase in agentic adversary activity.

Threat Actors

Storm-0940Microsoft Threat Intelligence attributed separate ARTEX activity to Storm-0940, including a supply-chain attack targeting ConnectWise customers; the article distinguishes that activity from the Vapor Panda campaign.VAPOR PANDACrowdStrike attributes the active campaign targeting more than 200 organizations and compromising about 140 sensitive targets to this China state-backed threat group.

Vendors

CrowdStrikesuccess in a campaign that already compromised about 140 sensitive targets in 11 days, according to CrowdStrike.MicrosoftThe active campaign attributed to Vapor Panda is separate from the ARTEX activity Microsoft Threat Intelligence attributed to Storm-0940 earlier this month, including a supply-chain attack targeting ConnectWise

Products

DeepSeekVapor Panda’s use of ARTEX, paired with DeepSeek, allowed it to accomplish more tasks with shocking speed — requests occurring as often as every 10 seconds — and pursue multiple attack paths concurrently.

Tools

ARTEXA China state-backed threat group is using ARTEX, the automated agentic AI penetration testing framework, to achieve remarkable speed, scale and success in a campaign that already compromised about 140 sensitive targets

Countries

Belgiumsemiconductor, defense, nuclear and financial sectors; and telecom providers in the United States, Belgium and the Philippines.ChinaA China state-backed threat group is using ARTEX, the automated agentic AI penetration testing framework, to achieve remarkable speed, scale and success in a campaign that already compromised about 140 sensitive targetsPhilippinesdefense, nuclear and financial sectors; and telecom providers in the United States, Belgium and the Philippines.United Statesa European country’s presidency and prime minister’s office, defense and intelligence agencies; 19 U.S.-based organizations in the pharmaceutical, semiconductor, defense, nuclear and financial sectors; and

Industries

Defensevictims include foreign ministries, a European country’s presidency and prime minister’s office, defense and intelligence agencies; 19 U.S.-based organizations in the pharmaceutical, semiconductor, defense,financialagencies; 19 U.S.-based organizations in the pharmaceutical, semiconductor, defense, nuclear and financial sectors; and telecom providers in the United States, Belgium and the Philippines.GovernmentVapor Panda’s broad-access campaign, which remains active, has targeted think tanks and government agencies spanning defense, justice, finance and diplomacy.intelligenceinclude foreign ministries, a European country’s presidency and prime minister’s office, defense and intelligence agencies; 19 U.S.-based organizations in the pharmaceutical, semiconductor, defense, nuclear andnuclearand intelligence agencies; 19 U.S.-based organizations in the pharmaceutical, semiconductor, defense, nuclear and financial sectors; and telecom providers in the United States, Belgium and the Philippines.pharmaceuticaland prime minister’s office, defense and intelligence agencies; 19 U.S.-based organizations in the pharmaceutical, semiconductor, defense, nuclear and financial sectors; and telecom providers in the United States,semiconductoroffice, defense and intelligence agencies; 19 U.S.-based organizations in the pharmaceutical, semiconductor, defense, nuclear and financial sectors; and telecom providers in the United States, Belgium and theThink tanksVapor Panda’s broad-access campaign, which remains active, has targeted think tanks and government agencies spanning defense, justice, finance and diplomacy.

Related Articles