Vapor Panda hacker group targets 200 organizations using AI

CrowdStrike has reported a major cyber espionage campaign conducted by Vapor Panda, a hacker group linked to China. Using an automated offensive penetration testing framework called ARTEX coupled with the DeepSeek language model, the group targeted more than 200 organizations across 14 countries in an 11-day period starting October 17, 2026.

The campaign utilized agentic AI to launch attacks at a scale previously unseen, with Adam Meyers, senior vice president of adversary operations at CrowdStrike, noting the system can execute 500 commands per hour compared to 40 for a human. The campaign targeted high-value sectors including defense, pharmaceuticals, semiconductors, nuclear energy, financial services, and telecommunications.

Confirmed or highly suspicious intrusions were identified in nine organizations, though the group attempted to breach approximately 140 targets. Affected entities include foreign ministries in Latin America and Europe, a Middle Eastern home ministry, and 19 organizations in the United States. Other targeted regions include Belgium and the Philippines.