On Oct. 29, 2026, CrowdStrike’s campaign report attributed a campaign to VAPOR PANDA. The company says one ARTEX controller was directed against entities in at least 14 countries over an 11-day window beginning Oct. 17. It reports ARTEX was used against more than 200 distinct organizations. The report names ministries, telecommunications providers, and organizations in the U.S. pharmaceutical, semiconductor, defense, nuclear and financial sectors among its targets. CrowdStrike says its account draws on company telemetry, exposed controller tooling, target files and recovered transcripts. These are CrowdStrike’s findings; Forkast has not independently verified the incident.
The more-than-200 figure describes reported targeting, not a count of confirmed compromises. CrowdStrike separately reports confirmed post-exploitation activity at nine organizations. In those cases, it says access was gained, the BLOODALCHEMY backdoor was deployed, and credential spraying, network scanning and reconnaissance followed. It also reports credential-spraying and credential-scanning activity at at least 12 additional organizations. Those figures describe different reported categories, not a single success-rate measure; CrowdStrike does not specify how the nine cases relate to the 200-plus target universe.
The account describes a human operator directing the work, rather than software acting autonomously. CrowdStrike says recovered transcripts contained operator instructions marked in Chinese as “human instruction,” with the person intervening at decision points. At a global pharmaceutical organization, CrowdStrike’s English translation of an operator instruction was: “find Windows machines in the domain without Falcon, judging by tasklist and folder listings.” The example shows a person directing agents to look for machines without the Falcon endpoint sensor.
CrowdStrike describes ARTEX as linking a main agent with planner and worker agents that share facts, findings and goals. In plain terms, the framework organized planning and task execution around shared information. The report says the agents pursued paths across web applications, cloud services, containers, directory systems, email and VPN, and shifted to alternatives when a path failed. Each of those operational details is CrowdStrike’s account of the campaign, not an independent observation by Forkast. CrowdStrike describes engagements advancing from initial access through host reconnaissance and movement between systems.
CrowdStrike contrasts the operation with earlier activity it had observed in which threat actors used AI agents to assist individual intrusions. It says VAPOR PANDA used ARTEX to run multiple engagements at once, with the operator stepping in at decision points. That is a description of coordinated software under human direction; it does not establish autonomous action.
CrowdStrike also reports BLOODALCHEMY at a Middle East-based interior ministry and a Latin American foreign ministry. Elastic Security Labs documented the backdoor on Oct. 13, 2023. That earlier analysis provides background on the malware, not confirmation of CrowdStrike’s report about its 2026 use.
On Oct. 21, 2026, Microsoft published a separate report about Storm-0940 activity involving ARTEX and a ConnectWise supply-chain compromise. CrowdStrike says the VAPOR PANDA activity is separate. Microsoft’s account does not independently corroborate CrowdStrike’s findings about this campaign.
The useful distinction is between the breadth of reported targeting, credential-related activity, and confirmed post-exploitation. The counts cannot be collapsed into a success rate, and a system coordinating many tasks is not, on this evidence, an autonomous operator. Keeping those boundaries intact is the difference between describing what CrowdStrike reported and claiming more than the report establishes.