Skip to content
Moojaz — موجز
Search
Menu
HomeRegionsMaghrebAfricaMiddle EastEuropeAsiaAmericasWorldSectionsPoliticsEconomySecurityHealthScienceTechnologyAIEnvironmentCultureSportsSearch
File

VAPOR PANDA: cyberespionage and AI agents

This dossier tracks CrowdStrike’s attribution of an ARTEX campaign to VAPOR PANDA and available verification.

Last updated : 1 key moments
CrowdStrike logo identifying the report’s publisher, not the campaign’s operators.
CrowdStrike logo identifying the report’s publisher, not the campaign’s operators. — CrowdStrike / VulcanSphere / Wikimedia Commons — public domain, PD-textlogo ; PNG rendering.

Where things stand

As of 29 October 2026, CrowdStrike reports 200-plus targets and nine post-intrusion cases; attribution remains the company’s assessment.

Reported information

CrowdStrike reports AI-assisted espionage campaign targeting over 200 organisations

CrowdStrike published a report on 29 October 2026 attributing a campaign using the ARTEX AI-agent framework to VAPOR PANDA. It says it observed more than 200 organisations targeted in at least fourteen countries over eleven days beginning on 17 October.

CrowdStrike logo identifying the report’s publisher, not the campaign’s operators.
CrowdStrike logo identifying the report’s publisher, not the campaign’s operators. — CrowdStrike / VulcanSphere / Wikimedia Commons — public domain, PD-textlogo ; PNG rendering.

Targets included ministries, defence and semiconductor businesses and telecom operators. CrowdStrike reports post-intrusion activity at nine organisations; that does not mean all 200-plus targets were compromised.

Its analysis says agents mainly used DeepSeek and another unidentified commercial model under human direction. Model use does not establish provider involvement. The scale and attribution rest on CrowdStrike telemetry and analysis, without equivalent independent verification in the sources reviewed.

Sources 2