According to CrowdStrike, the attackers used a tool called ARTEX to coordinate multiple attempted intrusions at once while a human operator directed the work. The firm says it confirmed post-intrusion activity at nine organisations, including deployment of malicious software. The figure of more than 200 refers to organisations targeted; it does not mean all were breached.
CrowdStrike describes the group as China-linked. That attribution and the full scope of the campaign are the firm’s assessment; the affected organisations have not all been publicly identified or independently confirmed. The report highlights how AI tools can help attackers scale existing cyber techniques, while human direction remained central to this operation.
Source: CrowdStrike OverWatch, 29 October 2026 — https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/
Image: AI-generated editorial illustration. It is symbolic and does not show the actual attackers, victims, systems or evidence.
