aiqbench analysis
The article centres on how a state-linked group used an agentic AI framework, ARTEX, to run multiple intrusions in parallel under a single human operator. For AI readers, the key point is the shift from AI assisting single attacks to one operator directing many autonomous engagements, which makes misuse of agent frameworks a practical concern rather than a theoretical one. The reporting also suggests the attacker built sensor-evasion logic into the agent workflow, so defenders should expect agent-driven operations to adapt to their security tooling.
VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign
CrowdStrike OverWatch identified a VAPOR PANDA campaign using ARTEX alongside the Chinese-developed DeepSeek large language model (LLM) and a second commercial LLM to conduct intrusions against multiple high-value targets in parallel. Beginning on October 17, 2026, the adversary used ARTEX against more than 200 distinct organizations worldwide, including foreign ministries in Latin America, Europe, Asia, and the Middle East; semiconductor, defense, and think tank organizations in the U.S.; and telecommunications providers in multiple regions. The VAPOR PANDA campaign detailed in this blog post is separate from the ARTEX activity recently reported by industry sources under the Storm-0940 designation.1 CrowdStrike has previously documented ARTEX and similar agentic frameworks in use by financially motivated and unattributed actors; in this campaign, a targeted intrusion adversary used ARTEX to run parallel intrusions against multiple high-value targets. CrowdStrike Falcon telemetry also revealed details absent from public ARTEX reporting, including VAPOR…
Excerpt shown under the publisher's RSS terms · 145 words · full text and figures are on the publisher's site