Threat Actor
VAPOR PANDA
- First Reported
- Oct 29, 2026
- Latest Reported
- Nov 2, 2026
Reported Context (5)
- CrowdStrike researchers identify Vapor Panda as the threat actor behind the reported campaign, which used ARTEX AI in simultaneous intrusions and deployed the BLOODALCHEMY backdoor. Vapor Panda Used ARTEX AI in Attacks Targeting More Than 200 Organizations
- The article describes this China state-backed group as using ARTEX to conduct attacks at scale and reportedly compromising about 140 targets in 11 days. The article does not link the group to the Chainalysis incident. Chainalysis Says Intruder Accessed Internal Tools and Customer Data
- CrowdStrike attributes the reported ARTEX-assisted intrusion activity to this China-based targeted intrusion adversary. The group is said to have targeted more than 200 organizations, with post-exploitation confirmed at nine. CrowdStrike Says Vapor Panda Used AI-Powered ARTEX Against 200+ Organizations
- CrowdStrike attributes the active campaign targeting more than 200 organizations and compromising about 140 sensitive targets to this China state-backed threat group. CrowdStrike Reports Vapor Panda Used ARTEX Against 200+ Organizations
- CrowdStrike attributed the campaign to VAPOR PANDA and linked the ARTEX controller to its infrastructure; the campaign included parallel intrusions and deployment of BLOODALCHEMY. VAPOR PANDA Uses ARTEX and LLMs to Scale Global Espionage Campaign
Malware (4)
People (2)
Threat Actors (6)
MITRE ATT&CK (18)
Vendors (3)
Products (6)
Tools (2)
Industries (10)
Countries (5)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.