CrowdStrike: China-linked group used ARTEX against 140 targets
October 30: CyberScoop reports CrowdStrike says China-linked Vapor Panda used ARTEX to compromise about 140 sensitive targets in 11 days, distinct from Storm-0940.
CrowdStrike says China-linked Vapor Panda used ARTEX to compromise about 140 sensitive targets in 11 days, separate from Storm-0940.
CrowdStrike told CyberScoop that the China state-backed group it tracks as Vapor Panda is using the agentic penetration-testing framework ARTEX, paired with DeepSeek, in an active campaign. Since October 17 the group targeted more than 200 organizations in at least 14 countries; about 140 sensitive targets were compromised in 11 days, and about 70 percent were confirmed compromised or assessed at moderate confidence. CrowdStrike says this activity is separate from Microsoft’s earlier ARTEX attribution to Storm-0940. Wiz, citing public cases, says AI agents are increasingly doing hands-on intrusion work under human objectives, including ARTEX against South Korean financial institutions and ConnectWise Cloud Backup, and Hermes at Thailand’s Ministry of Finance.
- About 140 sensitive targets compromised in 11 days, CrowdStrike told CyberScoop.
- More than 200 organizations targeted in at least 14 countries since October 17.
- About 70 percent confirmed compromised or assessed at moderate confidence.
- ARTEX activity exceeded 1,500 commands an hour versus up to 40 historically.
- CrowdStrike says this campaign is separate from Storm-0940’s earlier ARTEX use.
- Wiz cites Korean cases exposing data on about 67,000 people.
Timeline
dated events in the reporting · oldest first- Oct 17, 2026Vapor Panda’s ARTEX campaign began targeting organizations. · CyberScoop
What each outlet adds
beyond the shared facts- CyberScoopNames Vapor Panda, DeepSeek pairing, victim sectors and command rate.
- Wiz BlogPlaces ARTEX among Hermes, Korean, ConnectWise and other agentic cases.
- Vendors
- ConnectWiseMicrosoft
- Threat actors
- Vapor PandaStorm-0940
- AI models
- DeepSeek
Coverage
oldest first · one row per article · UTC- · 1d ago
Wiz BlogFirst report
Wiz says AI agents are doing hands-on intrusion work
Named cases include ARTEX and Hermes, plus three Wiz investigations that begin with an exposed Flowise service.
- · 1d ago
Wiz says AI agents are running hands-on intrusions
Named cases include ARTEX at Korean banks and ConnectWise, Hermes at Thailand's finance ministry, and AI-assisted API attacks in Japan.
- · 25m ago
CyberScoop
Vapor Panda used agentic AI tool ARTEX against about 140 targets
CrowdStrike says the China-linked campaign has hit more than 200 organizations in at least 14 countries since October 17.