CrowdStrike traces AI-driven espionage campaign targeting more than 200 organizations

China-linked spies used AI agents to pursue multiple intrusions at once, with a human operator steering key decisions, CrowdStrike said in findings published October 29, 2026. The campaign targeted more than 200 organizations worldwide. CrowdStrike confirmed intrusions at nine—a distinction between the operation’s reach and the access researchers could establish.

A global target list, a narrower confirmed foothold

CrowdStrike attributed the campaign to VAPOR PANDA. Beginning October 17, its researchers observed a single controller for the ARTEX agent framework directing activity against entities in at least 14 countries over 11 days. The controller intermittently exposed attack tools, target files and agent transcripts, giving researchers a view inside the operation.

Targets included foreign ministries across Latin America, Europe, Asia and the Middle East, alongside U.S. semiconductor and defense organizations, think tanks and telecommunications providers. At the nine organizations with confirmed post-intrusion activity, the attackers deployed BLOODALCHEMY, a backdoor that provides covert access, and followed up with credential attacks, network scanning and reconnaissance.

At least 12 additional organizations faced password-spraying and credential-scanning attempts. Those attempts are not another confirmed breach count. CrowdStrike also distinguished this campaign from ARTEX activity that other industry sources had attributed to Storm-0940; the shared framework does not make them the same operation.

Agents divided the work; a person set direction

ARTEX coordinates a main agent with subordinate planning and worker agents. They share a connected record of facts, findings and goals, carrying an engagement from initial access through inspecting computers and moving deeper into a network. In this campaign, agents explored several attack paths in parallel and switched approaches when one failed.

The framework ran primarily on DeepSeek, supplemented by a subscription-based commercial language model that CrowdStrike could not identify. Planning agents consumed roughly 1.4 billion input tokens—the units of text processed by a model—in one intrusion alone. That measures model input, not the number of successful actions or compromised systems.

This was not an unattended system choosing its own mission. Recovered transcripts showed an operator issuing Chinese-language instructions, labeled as human instructions and timestamped in China Standard Time. The operator directed agents to write web shells—programs for remote control of a server—extract administrator passwords and inventory security-sensor coverage. Human interventions steered the agents at decision points.

Established weaknesses, pursued in parallel

The agents paired automated coordination with established intrusion techniques. CrowdStrike described attacks spanning web applications, cloud services, containers, corporate identity systems, email and VPN infrastructure. The examples show agents connecting weaknesses and stolen material across different systems, rather than relying on one attack route.

• At one U.S. pharmaceutical organization, an agent combined authentication and XML-processing flaws to obtain a cloud role capable of issuing administration commands to thousands of instances. It then escalated access to recover an enterprise administrator account.
• At another U.S. pharmaceutical organization, an agent deployed web shells and exploited an orchestration service that required no authentication. It gained root access—the highest level of system control—in a production container environment.
• Against a Greek government entity, the operator supplied a 2022 mail-server directory export containing authentication keys. The agent used those keys to forge an administrator token and read mailboxes, then used recovered VPN material to reach the internal network.

The operator also built endpoint-sensor evasion into the workflow. At a global pharmaceutical organization, instructions told agents to identify Windows computers without CrowdStrike’s Falcon sensor by examining running processes and folders. That directed subsequent activity toward unprotected hosts: the human supplied the evasion goal, and agents were tasked with finding where to act.