Vapor Panda hackers breach 9 organizations, CrowdStrike says

CrowdStrike says Vapor Panda used ARTEX, a Go-based, superintelligence (SI)-powered security-testing tool, to gain access to organizations and carry out follow-on attacks. The worldwide campaign began 17 October 2026.

CrowdStrike attributes the campaign to Vapor Panda, previously VexatiousTemper, a China-based hacking group. The group overlaps with Earth Estries, a threat cluster tracked by security company Trend Micro.

CrowdStrike says Vapor Panda has sought long-term access to government, think tank, energy and mining organizations since 2021. It describes this campaign as the group’s first observed use of SI-driven intrusion tools, alongside an expansion into additional sectors and regions.

Targets, access and evidence

CrowdStrike says it observed exploitation attempts from a single ARTEX controller against entities in at least 14 countries over an 11-day window. It linked that controller to Vapor Panda infrastructure. Its evidence includes exposed tools, target files and agent transcripts, plus data from its Falcon security sensor showing backdoor deployment and the infrastructure used to control it.

Targets included foreign ministries across Latin America, Europe, Asia and the Middle East, and US organizations in the pharmaceutical, semiconductor, defense, nuclear and financial sectors. CrowdStrike says attackers compromised foreign ministries in Latin America, an interior ministry in the Middle East and telecommunications providers in the US, Belgium and the Philippines.

The confirmed follow-on activity included installing BLOODALCHEMY, a backdoor that provides covert remote access. Attackers also tried passwords across accounts, scanned networks and gathered information about the systems they reached, CrowdStrike says.

At a Greek government entity, CrowdStrike says an agent used authentication keys from an old mail-server directory export to read mailboxes. It then reached the internal network using recovered virtual private network (VPN) settings and a connection key that the operator said came from a May 2024 email leak.

How people directed the agents

ARTEX’s developer, Li Puhua, also known as Autumn-27, stopped making its code public after threat actors adopted it, The Hacker News said. CrowdStrike says Vapor Panda ran ARTEX mainly with DeepSeek, a Chinese-developed language model that processes text, supplemented by a subscription-based commercial model whose identity it could not confirm.

CrowdStrike describes ARTEX linking a main software agent with planner and worker agents—programs assigned parts of a task—that shared facts, findings and goals. The agents coordinated simultaneous intrusions, moving from initial entry to examining computers and moving between systems. They tried alternative approaches when a path failed.

A human operator still steered decisions. Recovered transcripts showed instructions to create web shells, scripts that allow remote control of a server, and obtain administrator passwords for the organization’s network. The operator also directed agents to identify computers without Falcon, allowing later activity to focus on machines lacking that protection.

CrowdStrike says planning agents consumed roughly 1.4 billion input tokens—pieces of text supplied to the models—in a single intrusion. It interprets that volume as evidence of automation at scale and assesses that parallel attack paths likely let one operator apply more techniques against more targets than manual work would allow.

What CrowdStrike recommends next

CrowdStrike recommends replacing authentication keys and service credentials after suspected data exposure, including when the exposed material comes from old backups or directory exports. It also recommends validating authentication signatures, limiting cloud command permissions, searching for ARTEX traces and patching internet-facing devices. Attack-detection and response tools should cover servers across the network, including those not reachable from the public internet.

CrowdStrike assesses that China-linked attackers are highly likely to keep adopting ARTEX-like frameworks alongside commercial language models over the next 12 months.