One operator, 200 targets: CrowdStrike says AI agents ran a global espionage campaign

Espionage used to be a staffing problem: each target needed its own team, its own hours, its own patience. CrowdStrike's latest report describes what happens when that constraint loosens. In an 11-day campaign that began on October 17, 2026, the China-linked group it tracks as VAPOR PANDA aimed an AI-driven intrusion framework at more than 200 organizations in at least 14 countries — and, according to recovered transcripts, a single human operator steered the operation at its decision points while software agents did the volume work.

The distinction inside the report matters as much as the scale. More than 200 organizations were targeted, but CrowdStrike confirmed post-exploitation activity — actual access followed by further action — at nine of them, with at least 12 more facing password-spraying attempts. Targeting is not the same as breaching. What is new is not that AI helped an intrusion, but that it let one operator run many at once.

What CrowdStrike found#

CrowdStrike's OverWatch team traced the activity to a single controller running ARTEX, an open-source agentic framework, which it linked to VAPOR PANDA infrastructure. The controller periodically exposed the operation's own workings — tooling, target files, and agent transcripts — giving researchers an unusually direct view of how the campaign ran.

The target list spans governments and strategic industries: foreign ministries in Latin America, Europe, Asia, and the Middle East; a Middle East-based interior ministry; one European country targeted across its foreign ministry, presidency, prime minister's office, and defense, justice, finance, and intelligence bodies; 19 U.S.-based organizations in pharmaceutical, semiconductor, defense, nuclear, and financial sectors; and telecom providers in the U.S., Belgium, and the Philippines. At the nine confirmed breaches, the attackers planted a backdoor called BLOODALCHEMY — first publicly documented in October 2023, here loaded by a legitimate binary renamed to look like a Windows system file — then moved on to credential spraying, network scanning, and reconnaissance.

How ARTEX works#

ARTEX is organized like a small team with a shared notebook. A main agent coordinates subordinate planner and worker agents, all reading and writing to a shared graph of facts, findings, and goals, and each engagement moves from initial access through host reconnaissance to lateral movement. The agents try multiple attack paths in parallel — web applications, cloud services, containers, Active Directory, mail and VPN infrastructure — and switch approaches when one fails.

The human is not out of the loop; the human is the bottleneck the system is designed around. Recovered transcripts show an operator issuing instructions in Chinese, marked with a label translated as "human instruction" and timestamped in China Standard Time, telling agents to write web shells, extract domain administrator passwords, and inventory endpoint sensor coverage. The operator intervenes at decision points and lets the agents grind through the rest.

The engines behind the agents are deliberately mixed: ARTEX ran primarily on the Chinese-developed DeepSeek model, supplemented by a second subscription-based commercial model CrowdStrike could not identify. The scale shows in one figure the report highlights: in a single intrusion, the planning agents consumed on the order of 1.4 billion input tokens, implying far greater consumption across the campaign.

Three intrusions that show the method#

The report's case studies matter because the agents' successes owe as much to old, unpatched weaknesses as to new technology. At one U.S.-based pharmaceutical company, the agent chained an unsigned SAML assertion with an XML external entity flaw to reach the cloud instance metadata service, obtained a role able to issue administration commands to thousands of instances, and from there recovered an enterprise administrator account. At a second, it planted web shells, abused an unauthenticated orchestration service to gain root access inside a production container environment, read Local Administrator Password Solution passwords, and misused delegation to impersonate a privileged account.

The third example is the most quietly damning. Against a Greek government entity, the operator handed the agent a 2022 directory export from the organization's mail server containing authentication keys likely never rotated since. The agent used those keys to forge an administrator token and read mailboxes, then reached the internal network through VPN configurations recovered from a user's sent mail and a VPN client key the operator said came from a May 2024 email leak. No exotic exploit was required — just credentials that should have been dead years ago.

The agents also worked around defenses directly. At a global pharmaceutical organization, the operator told them to find Windows machines in the domain without the Falcon sensor, judging by task lists and folder listings. Sensor-coverage checks built into the workflow let the operation concentrate on unprotected hosts.

Why this is a turning point#

CrowdStrike has previously seen threat actors use AI agents to assist individual intrusions. The change here is parallelism: several engagements at once, directed by one operator. A security team that could previously assume an attacker would work its targets sequentially must now assume simultaneous pressure across many fronts, with agents re-trying failed paths without waiting for a human to wake up.

It also suggests the framework itself is spreading. CrowdStrike stresses that this campaign is separate from ARTEX activity other researchers reported under the name Storm-0940, and reads the two operations as evidence that the framework is quickly gaining popularity among multiple China-linked adversaries. Its assessment is blunt: China-linked adversaries will highly likely keep adopting agentic frameworks like ARTEX over the next 12 months, pairing them with commercially available models, and enabling small teams to scale intrusions across many targets at once.

Attribution rests on CrowdStrike's assessment — the China-nexus label, the link between the controller and VAPOR PANDA infrastructure, and the operator's language and timestamps are the vendor's evidence, and no response from the accused parties is included in the report. What does not depend on attribution is the defensive lesson: the intrusions succeeded through familiar lapses — unsigned SAML assertions, unrotated keys in old exports, unauthenticated services, unpatched appliances, hosts with no endpoint sensor — found faster because agents did the searching.

What to watch#

Three things will show whether this campaign is a preview or an outlier. First, whether other vendors report ARTEX in the wild, and whether its adoption spreads beyond China-linked groups. Second, whether model providers say anything about abuse of their services in agent-driven intrusions — the report's unidentified second model leaves that question open. Third, whether the hygiene the report recommends actually happens: rotating keys in old backups and directory exports, enforcing SAML signature validation, requiring IMDSv2, hunting for ARTEX markers like artx-prefixed cloud roles, and putting endpoint detection on servers assumed unreachable from the internet. The agents are new. The doors they walked through are not.

Sources: CrowdStrike's October 29, 2026 report, VAPOR PANDA Uses AI-Driven ARTEX to Grow Global Espionage Campaign; Unite.AI's summary of the findings; SecurityBrief's coverage of the campaign. Attribution and technical claims are CrowdStrike's. Cover and inline images are AI-generated editorial illustrations.