Vapor Panda
Also known as VexatiousTemper
China-nexus targeted intrusion adversary tracked by CrowdStrike, formerly tracked as VexatiousTemper, active since at least 2021 against government, think tank, energy and extractive organisations across Europe, North America, Oceania and the UK. From 17 October 2026 CrowdStrike observed it run the agentic AI framework ARTEX, mainly with DeepSeek plus a second commercial LLM, from a single controller against more than 200 organisations in at least 14 countries, including foreign ministries in Latin America, Europe, Asia and the Middle East, US pharmaceutical, semiconductor, defense and nuclear organisations, and telecommunications providers. A human operator steered the agents in Chinese, including instructions to find hosts without the CrowdStrike Falcon sensor. Post-exploitation at nine organisations included deployment of the BLOODALCHEMY backdoor, side-loaded by a renamed GameHook binary. CrowdStrike states this campaign is separate from the ARTEX activity tracked as Storm-0940. The Hacker News reports, without a CrowdStrike quote, that the group overlaps with Trend Micro's Earth Estries; this overlap is recorded as a similar relation, not as a synonym.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
Recent activity
- CrowdStrike says China-linked hackers used AI agents to target over 200 organizations CrowdStrike reports that the group it calls VAPOR PANDA used an AI agent fmastodon · Nov 6, 2026
- VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign # VAPORPANDA # ARTEX https://www. crowdstrike.com/en-us/blog/vap or-panda-uses-artex-to-scmastodon · Nov 5, 2026
- VAPOR PANDA hackers use multi-agent AI to target government, pharmaceutical, semiconductor, defense organizations https:// industrialcyber.co/ransomware/ vapor-mastodon · Nov 5, 2026
- Vapor Panda, a Chinese nation-state threat actor, has been running these AI-assisted campaigns since October 17, and frankly the automation is working exactly amastodon · Nov 4, 2026
- ---------------- 🎯 AI =================== Executive summary RST Labs' scan of 2 November 2026 counts more than 1,300 internet-facing consoles across three mastodon · Nov 4, 2026
- 🤖 WorkOS breach (Oct 30): an AI offensive framework automated recon and exploitation of its internal sales app. Founder links it to ARTEX AI, the pentest suitemastodon · Nov 3, 2026
- Unfortunately, it looks like political BS is infecting threat reports now. This morning a journalist asked my opinion on this attack campaign, referencing a Cromastodon · Nov 3, 2026
References
- https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/
- https://thehackernews.com/2026/10/chinese-hackers-use-ai-powered-artex-to.html
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.