Severity major: The campaign reached more than 200 organisations across at least 14 countries, with confirmed post-exploitation at nine, meeting the many-third-parties rung.
Happened 2026-10-17 · Earliest source we hold 2026-10-29, 12 days later · Captured by AI Risk Wire 2026-10-30 01:29 UTC
China-linked threat actor VAPOR PANDA used ARTEX, an open-source agentic AI framework running DeepSeek and a second commercial LLM, to conduct simultaneous intrusions against more than 200 organisations in at least 14 countries from October 17, 2026.
Risk grouping: Not yet classified
No source we hold states: who caused it, intended or not, before or after release, the ai's part.
The story
1 · What it was doingVAPOR PANDA ran ARTEX, an open-source agentic framework using DeepSeek and a second commercial LLM, with a main agent plus planning and worker agents. A human operator issued instructions in Chinese, directing agents to build web shells, extract domain administrator passwords and map endpoint security across targeted networks.
2 · What went wrongThe agents carried out intrusions against more than 200 organisations, gaining access, deploying the BLOODALCHEMY backdoor and conducting credential spraying, network scanning and reconnaissance, breaching the security boundaries of victim networks.
3 · What it reached or didActivity hit organisations in at least 14 countries, including foreign ministries, an interior ministry, defence and intelligence entities, 19 US organisations and telecom providers in the US, Belgium and the Philippines. Post-exploitation was confirmed at nine organisations.
4 · How it was caughtCrowdStrike's OverWatch team observed the exploitation activity from a single ARTEX controller directed against organisations in at least 14 countries over an 11-day period.
5 · What was doneCrowdStrike published the findings and recommended rotating signing keys, preauthentication keys and service credentials, enforcing SAML signature validation, requiring IMDSv2, restricting cloud role command-execution permissions, patching internet-facing systems and deploying EDR agents.
What the sources state
What set it off misused by a person
No source states: when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause.
web shell development, credential extraction, network scanning, lateral movement
C one secondary source states it
How much it acted alone
it acted alone, watched by a person
C one secondary source states it
How it was connected
agent with tools
C one secondary source states it
What it was for
conducting simultaneous intrusions against organisations
C one secondary source states it
What happened
When it happened
2026-10-17
C one secondary source states it
Earliest source we hold
2026-10-29
A the date the source itself carries
What set it off
misused by a person
C one secondary source states it
Who caught it
an outside party
C one secondary source states it
Themes
agentic AI, espionage, credential theft, backdoor, china linked
C one secondary source states it
Who caused it
an outside attacker
C one secondary source states it
What went wrong
security breach
C one secondary source states it
AI agent
an AI agent acted
C one secondary source states it
Impact
Severity
major
D inferred by us from the described behaviour, reason shown
Kind of harm
others' security, operations
C one secondary source states it
Who was affected
more than 200 organisations worldwide, including government institutions, pharmaceutical companies, semiconductor organisations, defence entities and telecommunications providers
C one secondary source states it
Kinds of data exposed
credentials
C one secondary source states it
Why this severity
The campaign reached more than 200 organisations across at least 14 countries, with confirmed post-exploitation at nine, meeting the many-third-parties rung.
D inferred by us from the described behaviour, reason shown
Context
Industry
Public Administration
D inferred by us from the described behaviour, reason shown
LR-2026-0279 · version 4 · published 2026-10-30 after automatic checks; not yet checked field by field by a person · changes to this case · JSON