The facts
CrowdStrike observed the campaign from 17 October across at least 14 countries over an 11-day window. Targets included ministries, telecommunications providers and US pharmaceutical, semiconductor and defence organisations. [1]
The company says nine organisations showed access followed by BLOODALCHEMY backdoor deployment and further reconnaissance. The report attributes the operation to VAPOR PANDA; that is a research assessment. [1]
Recovered tooling and transcripts showed ARTEX coordinating AI agents under human direction, primarily using DeepSeek and an unidentified commercial model, according to CrowdStrike. [1]
The Hacker News reported the findings on 30 October. Its account relies on CrowdStrike's investigation and does not provide an independent audit of every intrusion. [2]
Still unconfirmed
- The complete victim list, full data-loss scope and independent confirmation of every reported compromise are not established here.
Sources
References support the numbered facts above. Source checks: 30 Oct 2026, 17:28 UTC.
Original CrowdStrike research and independently owned reporting were read. Attribution and victim totals remain the researcher's findings. No exploit instructions or unsupported claim of 200 successful breaches is included.
- VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign
CrowdStrike Intelligence / OverWatch · Primary source · 29 Oct 2026
Actual original analysis and targeting sections read. Attributes the campaign using telemetry, exposed infrastructure and transcripts. Target files, probable compromise and confirmed post-exploitation are different evidence levels; not all targets are named.
- Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide
The Hacker News / Ravie Lakshmanan · Reporting · 30 Oct 2026
Actual report read. Independently owned from CrowdStrike but relies on that research; it is not a second independent compromise count. This is distinct from the separately tracked Storm-0940 activity.