For years, defenders have comforted themselves with one fact about state-backed hacking crews: there are only so many skilled operators, and each can only work so many keyboards. A report CrowdStrike published on October 29 suggests that limit is getting looser.
According to CrowdStrike, a China-nexus group it tracks as VAPOR PANDA has been using ARTEX, an agentic penetration-testing framework, to run an espionage campaign against more than 200 distinct organizations. The company says one controller was seen directing operations across at least 14 countries over 11 days. An "agentic" tool, in this sense, is software that plans and carries out multi-step tasks on its own, using an AI model to choose the next step, instead of waiting for a person to type each command.
What CrowdStrike Says Happened
The Hacker News, reporting on CrowdStrike's findings, says the campaign began on October 17, 2026. ARTEX is written in Go, and CrowdStrike says the group ran it primarily with the Chinese-developed DeepSeek AI model, supplemented by a second subscription-based commercial model that CrowdStrike could not confirm.
The target list reads like a standard espionage wish list. CrowdStrike says it included foreign ministries, 19 U.S. organizations in pharmaceuticals, semiconductors, defense, nuclear and financial services, and telecommunications providers in the United States, Belgium and the Philippines.
How many of those attempts worked depends on what you count. CyberScoop reports that, per CrowdStrike, about 140 targets were compromised in the 11-day window, which is roughly 70 percent of targets judged compromised with either confirmed or moderate confidence. A narrower set is firmer: CrowdStrike says it confirmed post-exploitation activity at nine organizations, meaning the attackers went past initial access and did things inside the network. At those nine, the group deployed BLOODALCHEMY, a backdoor The Hacker News describes as a derivative of ShadowPad, a modular malware family long associated with China-linked operators. CrowdStrike also saw password spraying and credential scanning against at least 12 more organizations. Password spraying means trying a few common passwords across many accounts, which keeps each account below lockout limits.
That spread is worth keeping in mind when you see the headline numbers. "About 140 compromised" includes moderate-confidence judgments. Nine is the count where CrowdStrike says it has confirmed what the intruders did after getting in.
Who Is VAPOR PANDA?
Per The Hacker News, VAPOR PANDA was previously tracked by CrowdStrike as VexatiousTemper, and its activity overlaps with the group Trend Micro calls Earth Estries. The China link is CrowdStrike's assessment. The sources do not name a specific government agency or unit behind the group.
CrowdStrike also says this campaign is separate from ARTEX activity Microsoft has attributed to a cluster it tracks as Storm-0940. Put simply, more than one operator now appears to be using the same framework. That matters because tracking a tool is no longer the same as tracking a single group.
Why the Speed Matters
What's new here is less the targets or the backdoor than the pace. CyberScoop reports that the group's requests came as often as every 10 seconds, and quotes CrowdStrike's Adam Meyers saying hands-on-keyboard activity the company has tracked for 15 years typically involved up to 40 commands per hour, while with ARTEX "we could see it exceed 1,500 commands an hour."
Meyers, senior vice president of counter adversary operations at CrowdStrike, told CyberScoop that this is the first time the company has seen an agentic nation-state threat actor at this scale. CrowdStrike describes the campaign as an escalation: one human operator can now direct many intrusions at once, with AI agents doing much of the repetitive scanning, probing and follow-up that used to soak up operator hours.
For defenders, that changes the math in two ways. First, the gap between a weakness appearing and someone testing it may shrink, because an automated agent does not get tired or need to triage its to-do list. Second, the volume itself can be a giveaway. A human intruder going slowly can blend in, while a tool firing a request every few seconds at sustained rates leaves a pattern that good telemetry can spot, if anyone is watching.
What It Means for Defenders
Who is affected. Based on CrowdStrike's reporting, the highest-risk sectors are government and foreign-affairs bodies, telecommunications providers, and U.S. organizations in pharmaceuticals, semiconductors, defense, nuclear and finance. The geographic reach of at least 14 countries means this isn't a regional problem.
What to check. The sources don't tie the campaign to a single vulnerability or name fixed software versions, so there is no single patch that closes this. Defenders should focus on the behaviors the reports describe:
- Password spraying. CrowdStrike saw spraying and credential scanning against at least 12 organizations. Review authentication logs for low-and-slow failed logins spread across many accounts from the same sources. Enforce multi-factor authentication on every internet-facing login, especially VPNs, webmail and remote-access portals, and remove or disable dormant accounts that spraying tends to find.
- Machine-speed activity. Requests every 10 seconds and command rates far beyond human typing speed are a detection opportunity. Tune alerting for sustained, high-frequency probing of public services and for bursts of commands in a single session that no administrator would plausibly run by hand.
- BLOODALCHEMY and ShadowPad-family malware. Make sure endpoint detection covers ShadowPad derivatives, and pull the indicators of compromise CrowdStrike has published into your detection tools. Organizations in the targeted sectors should treat a hit as a confirmed incident, not a false positive to tune out.
- Rotate after suspicion. If you find spraying that succeeded, or any sign of the backdoor, reset the affected credentials, revoke active sessions and tokens, and review what those accounts could reach.
- Threat-intel hygiene. Because ARTEX is also tied to Microsoft's Storm-0940 activity, map detections to the tool's behavior instead of to a single group name, so you catch it no matter who is running it.
The bigger takeaway. The basics still apply. MFA, account hygiene, exposed-service inventory and endpoint monitoring blunt an AI-driven intruder for the same reasons they blunt a human one. The difference is the margin for error. When an adversary can run many intrusions at once, an unpatched edge device or a weak password gets found faster, so closing those gaps quickly matters more than it used to.
