CrowdStrike: AI agents used in parallel attacks against more than 200 organisations

What is changing?

CrowdStrike OverWatch says the threat actor VAPOR PANDA used the ARTEX agent framework to run numerous intrusions in parallel. According to its October 29 report, the 11-day campaign began on October 17 and targeted more than 200 organisations across at least 14 countries. CrowdStrike says it confirmed access, deployment of the BLOODALCHEMY backdoor and follow-on credential and network reconnaissance activity at nine organisations.

ARTEX ran primarily on DeepSeek, supplemented by a commercial model that CrowdStrike could not identify. A main agent coordinated planner and worker agents over a shared task graph, while a human operator intervened at critical decision points. CrowdStrike reports that planning agents consumed about 1.4 billion input tokens in one intrusion and pursued web, cloud, container, Active Directory and VPN paths in parallel.

CrowdStrike says this campaign is separate from the Storm-0940 ARTEX activity previously disclosed by Microsoft. The findings point not to fully autonomous attacks but to a small team using AI agents to pursue a broader target set simultaneously. CrowdStrike recommends rotating old keys, enforcing SAML validation, restricting cloud roles and auditing endpoint-sensor coverage.