CrowdStrike: one operator steered AI agents at 200+ orgs

The headline number is 200 targets. The number that matters is one operator.

CrowdStrike said on Oct. 29 that VAPOR PANDA, a China-nexus intrusion group, used an agentic framework called ARTEX against more than 200 organizations in at least 14 countries. The activity began Oct. 17, and CrowdStrike observed it over an 11-day window. It confirmed post-exploitation at nine organizations.

How ARTEX runs an intrusion

CrowdStrike describes a main agent that coordinates planner and worker agents, all sharing a graph of facts, findings and goals. It is a multi-agent system pointed at a network. Each engagement moves from initial access to host reconnaissance to lateral movement.

The models were mainly DeepSeek, plus a second, subscription-based commercial model that CrowdStrike could not identify. In one intrusion, the planning agents consumed about 1.4 billion input tokens.

A human stayed in the loop. The operator issued instructions in Chinese, labeled "human instruction" and timestamped in China Standard Time, and stepped in at decision points. CrowdStrike says that let one person run several engagements at the same time.

TopFive covered an earlier ARTEX case on Oct. 9. CrowdStrike says this campaign is separate from the ARTEX activity Microsoft attributed to Storm-0940, and calls it VAPOR PANDA's first observed use of AI-driven intrusion tooling.

The agents found old mistakes

The ways in that CrowdStrike describes are familiar ones.

At one US pharmaceutical company, the agents used an unsigned SAML assertion and an XXE flaw to query the cloud instance metadata service. That yielded a role that could issue commands to thousands of instances, and eventually an enterprise admin account.

At a Greek government entity, a 2022 directory export with likely unrotated keys let them forge an admin token and read mailboxes.

At a global pharmaceutical organization, the operator told the agents to find Windows machines without CrowdStrike's Falcon sensor, then focused follow-on work on those hosts.

Confirmed victims include two Latin American foreign ministries, a Middle East interior ministry, and telecom providers in the US, Belgium and the Philippines.

What it means for you

Agents don't need to be brilliant to be dangerous. They need to be tireless, and tireless finds the key you forgot to rotate in 2022.

CrowdStrike's recommendations, condensed:

• Rotate signing keys, preauthentication keys and service credentials after any suspected exposure.
• Enforce SAML signature validation and require IMDSv2.
• Limit cloud roles' command-execution permissions.
• Patch internet-facing appliances, especially long-lived Linux servers.
• Hunt for ARTEX markers, such as "artx" or "artex" in command lines and a C:\ProgramData\artx5v\ directory.

CrowdStrike also recommends deploying an advanced endpoint detection agent across the environment, including on servers not exposed to the internet. CrowdStrike sells one, so read that line as a vendor's advice. The rest stands on its own.

What to watch

CrowdStrike assesses that China-nexus groups will "highly likely" keep adopting agentic frameworks like ARTEX over the next 12 months, paired with commercial models. Watch for the second, unnamed model to be identified, and for its provider to say what it did about the accounts.

Rotate the old keys. Today.