One operator. Two hundred organizations.
By Callahan Blackwood | November 9, 2026
A skilled human operator running intrusion tools manages roughly 40 commands an hour. That figure comes from fifteen years of CrowdStrike observation. The China-linked group now designated VAPOR PANDA ran 1,500 commands an hour inside target networks this October. The difference is not tradecraft; it is architecture.
VAPOR PANDA deployed AI agents to do the work. The model at the center of the operation was DeepSeek, the Chinese large language model the United States government had already ordered removed from federal systems over data-handling concerns. That order came on October 20. The campaign had been running since October 17.
VAPOR PANDA, the name CrowdStrike assigned to this group, was first identified in February 2021 under the label VexatiousTemper. Trend Micro tracks the same cluster as Earth Estries. The group has had five years of documented activity before this campaign. What changed in October 2026 was not who they are, but how fast they can move.
That is the core tension in what CrowdStrike is calling the first documented nation-state agentic cyber campaign at scale: a model the government banned for data risks running offense in real time while the government debated defense.
The Framework and the Speed
ARTEX is a framework written in Go. It deploys AI agents in a layered structure: planning agents above, worker agents below, with a human operator at the top directing the chain. CrowdStrike's October 29 threat report describes the architecture as moving from initial host access through mapping to network spread, with agents handing tasks to one another rather than waiting for a person to issue each command.
Adam Meyers, CrowdStrike's head of counter adversary operations, told CyberScoop that the typical human operator clocks about 40 commands an hour over a fifteen-year baseline. ARTEX broke that ceiling by a factor of nearly 38. "This is the first time that we're seeing an agentic adversary nation-state threat actor at this scale," Meyers said. He added that the economics change the problem entirely: "It costs them very little to run a mass-exploitation campaign."
A single intrusion tracked by CrowdStrike consumed roughly 1.4 billion input tokens in its planning phase alone. That is not a transcription error. It illustrates how much reasoning the agents were doing inside a target environment before a human operator had to issue another instruction.
VAPOR PANDA paired DeepSeek with a second, unidentified subscription-based commercial model. CrowdStrike found no evidence that DeepSeek the company participated in or had knowledge of the campaign. The models appear to have functioned as inference engines, not partners.
Five Weeks, Two Hundred Targets
The campaign began October 17, 2026. CrowdStrike's report, published October 29, described the operation as still active at that point. In roughly eleven days of tracked activity, VAPOR PANDA touched more than 200 organizations across at least 14 countries.
The target list reads like a catalog of institutional authority. In one European country, attackers reached the foreign ministry, the presidency, the prime minister's office, and the ministries of defense, justice, finance, and intelligence simultaneously. Foreign ministries in Latin America, Central America, and Asia were targeted. A Middle East interior ministry was hit. In the United States, 19 organizations appeared on the list: pharmaceutical companies, semiconductor firms, defense contractors, nuclear sector entities, financial institutions, and think tanks. Telecoms in the United States, Belgium, and the Philippines were also targeted.
This was not random. The concentration of foreign ministries, defense establishments, and intelligence agencies in a single European country, hit at once, reflects deliberate prioritization. The breadth of U.S. targets, spanning sensitive economic sectors and entities with access to government research, also reflects deliberate prioritization.
Victims have not been named publicly. No government has confirmed a breach on the record.
Stale Keys and Sent Mail
Inside target networks, the agents moved with a logic that combined automation and accumulated tradecraft.
The human operator directed the broader campaign. Agents below handled execution: web shells for persistent access, domain administrator password extraction, and checks against security sensors to avoid triggering alerts. Agents chained authentication weaknesses and cloud configuration gaps, exploiting failures that organizations had often left unaddressed for years.
One example in CrowdStrike's report stands out. In a Greek government environment, VAPOR PANDA exploited credentials from 2022, four years old at the time of the attack. The agents used those stale keys to forge an administrator token by locating VPN configuration data embedded in sent mail. The mailbox contained the keys to the network. Nobody had rotated the credentials or audited the inbox.
VAPOR PANDA also installed BLOODALCHEMY, a malware implant derived from ShadowPad, a backdoor with a documented history across Chinese state-linked operations. BLOODALCHEMY signals an intent to maintain access over time, not just gather intelligence in a single pass. The attackers were not in a hurry to leave.
Confirmed vs. Probable: The Gap Matters
The word "compromise" gets stretched in breach reporting. Here are the numbers as stated, with their caveats intact.
CrowdStrike confirmed 9 cases of post-exploitation, meaning attackers moved beyond initial access and operated inside the target environment with demonstrated effect. At least 12 additional organizations were hit with password spraying or credential scanning, a step that may or may not have led to deeper access. CyberScoop, citing the broader campaign picture, reported that roughly 70 percent of targeted organizations, approximately 140 in total, were confirmed compromised or showed successful intrusion indicators at moderate confidence.
Moderate confidence matters as a qualifier. It means analysts saw indicators consistent with intrusion but lacked the forensic certainty of full post-exploitation confirmation. The gap between 9 fully confirmed and 140 at moderate confidence is wide. RFTUV News Room reports both numbers because readers deserve to know which is which.
The numbers agree on this: the campaign reached a large number of organizations in a short time, and the human cost of running it was low.
The DeepSeek Paradox
On October 20, three days after VAPOR PANDA began its campaign, the Department of Homeland Security ordered federal civilian agencies to stop purchasing DeepSeek and to remove it, along with any third-party products built on the model, from government systems. The order cited data-handling concerns. Under Chinese law, U.S. user data processed by DeepSeek could potentially be accessible to Chinese authorities. A law passed in December 2025 had already restricted DeepSeek's use in national-security systems.
China's foreign ministry pushed back. It called the restrictions an example of "overstretching the concept of national security and politicizing technology and trade issues."
VAPOR PANDA's use of DeepSeek was not covered by those restrictions. The model ran outside U.S. government networks, inside target environments the attackers had already penetrated. The ban addressed data flowing out. The attack was about access flowing in. The U.S. government has not issued a public statement specifically addressing VAPOR PANDA or ARTEX.
The juxtaposition is not incidental. The U.S. government identified DeepSeek as a potential channel for Chinese intelligence collection from U.S. systems. A Chinese state-linked group used DeepSeek as an offensive reasoning engine against U.S. targets in the same month. Both concerns are distinct. Both are documented. They do not cancel each other out.
Check Point Research, in findings published November 9, identified an operational detail that shows how the campaign routed around content restrictions. In monitored instances of ARTEX deployments, safety filters triggered only when Anthropic's Opus model was in use. When those filters triggered, the operator switched to more permissive Chinese models. DeepSeek Flash appeared most frequently across the 10 exposed instances Check Point examined. The architecture was designed to route around content restrictions by swapping models when one refused to cooperate.
What Check Point's Scan Revealed
Check Point's November 9 report extends the picture beyond the VAPOR PANDA campaign. Across public-facing infrastructure, analysts found 2,557 systems hosting ARTEX deployments. Of those, 1,608 were live and publicly accessible at the time of the scan.
In one campaign tracked through exposed agent logs, Check Point counted 400,791 agent messages executing 292 discrete objectives. The human operator issued no further prompting once the campaign began. The agents ran it.
An iOS-targeted campaign in the same data set generated roughly 36 billion tokens of agent activity and an estimated cost of between $700 and $1,500 at DeepSeek's pricing rates. The campaign touched more than 300 certificates. At commercial API rates, the marginal cost of a nation-state intrusion campaign falls into the range of a midsize marketing budget.
The model distribution across those 10 exposed instances put Chinese models at the top. DeepSeek Flash was the most frequent choice, consistent with the operational preference Check Point documented across the guardrail bypass evidence.
ARTEX Is Not One Group's Tool
VAPOR PANDA is not the only actor using ARTEX, and October 17 is not the framework's first documented deployment.
Microsoft attributed a separate ARTEX-based operation, also in October, to Storm-0940, a distinct threat actor. That campaign entered through a supply-chain attack on ConnectWise and reached more than 2,250 cloud tenants. At peak, it generated roughly 2,900 sign-in attempts per minute.
Zscaler researchers found ARTEX in use across multiple threat clusters. The framework's developer subsequently took it closed-source, a move that may slow adoption by less resourced groups but constrains nobody who already has access.
The trend data makes the direction clear. CrowdStrike tracked roughly 45 agentic-adversary attacks in September 2026. The October count, through the date of publication, reached 126. That is close to a threefold rise in one month.
The Defenses Nobody Did
Every defense that would have stopped ARTEX or limited its reach appears in security guidance that most organizations have already received and not acted on.
Rotate exposed credentials. Stale authentication keys from 2022 should not exist in a production environment in 2026. VAPOR PANDA found them, forged tokens with them, and walked into an administrator account through an unaudited mailbox. That is not a sophisticated attack chain. It is a maintenance failure.
Harden cloud sign-in. Configuration weaknesses in cloud environments gave agents a path to chain through systems without triggering alerts. Cloud security posture management has existed as a practice for years.
Patch internet-facing systems. ARTEX's documented entry vector was unpatched systems. The patches existed. They were not applied.
Extend endpoint monitoring to cover the environments where ARTEX operated. Organizations with limited visibility into their own networks cannot detect agents moving through them at 1,500 commands per hour.
None of these recommendations came from the VAPOR PANDA campaign. They predated it. The campaign succeeded at scale because baseline hygiene was absent at scale across government ministries, defense contractors, telecoms, and think tanks in at least 14 countries simultaneously.
The switch to agentic tooling is new. The targets and the institutional patience of the group behind them are not. VAPOR PANDA has operated for five years. What changed in October 2026 is that a human operator can now direct hundreds of agents running at nearly 38 times the speed of a person, at a cost low enough that the barrier to mass exploitation is no longer labor. It is infrastructure. And the infrastructure runs on software that costs somewhere between $700 and $1,500 to deploy against a campaign touching hundreds of targets across a continent.
