CrowdStrike: Vapor Panda ran intrusions with DeepSeek-based agents
Comments on “CrowdStrike: Vapor Panda ran intrusions with DeepSeek-based agents”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
CrowdStrike reports that VAPOR PANDA, a China-nexus group, used the ARTEX agent framework, mostly with DeepSeek, to run parallel intrusions starting October 17, 2026. A single controller targeted entities in at least 14 countries over 11 days, with post-exploitation confirmed at nine organizations. A human operator steered agents and told them to find hosts without the Falcon sensor. The figures come from CrowdStrike alone, with no independent sourcing. Defenders should rotate exposed keys and hunt for ARTEX markers.
Why it ranked
No. 4 of 111 with a score of 0.75. The panel rated it highest on new information (0.87) and reader interest (0.86), lowest on audience breadth (0.70). Placed No. 4, No. 5 by score alone: the placement terms moved other stories past it.
- AI judgeJudge 2claude-haiku-5-5
- Detailed threat intelligence on a state-linked campaign using AI agents; substantiated with IOCs and ATT&CK mapping, highly relevant to security builders, with some new details beyond prior ARTEX coverage.
- AI judgeJudge 3gpt-5.6-luna
- A detailed threat report documents AI-assisted, parallel intrusions across governments and major industries, with attack paths, telemetry, malware details, IOCs, ATT&CK mappings, and defensive recommendations. It is highly relevant and actionable, with modest vendor-promotion risk.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.75total under rubric v2.3
- Significance0.73
- Reader interest0.86
- Audience breadth0.70
- Practical relevance0.77
- Substantiated0.85
- Technical depth0.81
- New information0.87
- Counts against: Promotional0.09
- Counts against: Overclaim0.20
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.70 | 0.60 | 0.88 | 0.73 | 0.28 | +0.24 | +0.175 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.77 | 0.85 | 0.96 | 0.86 | 0.19 | +0.26 | +0.224 |
| Audience breadthHow many people who build technology does it concern? | 0.77 | 0.60 | 0.72 | 0.70 | 0.17 | +0.13 | +0.090 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.73 | 0.70 | 0.88 | 0.77 | 0.18 | +0.22 | +0.169 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.84 | 0.80 | 0.90 | 0.85 | 0.10 | +0.05 | +0.042 |
| Technical depthHow technically substantive is it? | 0.86 | 0.70 | 0.86 | 0.81 | 0.16 | +0.05 | +0.040 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.86 | 0.80 | 0.94 | 0.87 | 0.14 | +0.05 | +0.043 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.05 | 0.10 | 0.12 | 0.09 | 0.07 | −0.19 | −0.017 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.22 | 0.25 | 0.12 | 0.20 | 0.13 | −0.11 | −0.022 |
| Sum of contributions | +0.745 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.745 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-31/4/"><img src="https://rubric.hrih.si/badge/2026-10-31/4.svg" alt="Ranked #4 on Rubric, 31 Oct 2026" width="238" height="28"></a>Claim check
Claim check: 8 no source given. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No source givenNumber
Beginning on October 17, 2026, VAPOR PANDA used ARTEX against more than 200 distinct organizations worldwide.
The article gives no link or citation for it.
The article says “Beginning on October 17, 2026, the adversary used ARTEX against more than 200 distinct organizations worldwide”
The source says No source to compare with.
No source givenNumber
A single ARTEX controller directed exploitation activity against entities in at least 14 countries over an 11-day window.
The article gives no link or citation for it.
The article says “directed against entities in at least 14 countries over an 11-day window”
The source says No source to compare with.
No source givenNumber
CrowdStrike Intelligence confirmed post-exploitation activity at nine organizations, where the adversary deployed BLOODALCHEMY.
The article gives no link or citation for it.
The article says “CrowdStrike Intelligence confirmed post-exploitation activity at nine organizations, where the adversary gained access, deployed BLOODALCHEMY”
The source says No source to compare with.
No source givenNumber
In a single intrusion, VAPOR PANDA's planning agents consumed on the order of 1.4 billion input tokens.
The article gives no link or citation for it.
The article says “In a single intrusion, VAPOR PANDA’s planning agents consumed on the order of 1.4 billion input tokens”
The source says No source to compare with.
No source givenDate
BLOODALCHEMY is a backdoor first publicly documented in October 2023.
The article gives no link or citation for it.
The article says “BLOODALCHEMY, a backdoor first publicly documented in October 2023”
The source says No source to compare with.
No source givenGeneralization
The VAPOR PANDA campaign is separate from the ARTEX activity reported by industry sources under the Storm-0940 designation.
The article gives no link or citation for it.
The article says “The VAPOR PANDA campaign detailed in this blog post is separate from the ARTEX activity recently reported by industry sources under the Storm-0940 designation”
The source says No source to compare with.
No source givenFirst, only or fastest
This campaign is the first observed use of AI-driven intrusion tooling by VAPOR PANDA.
The article gives no link or citation for it.
The article says “This campaign marks the adversary's first observed use of AI-driven intrusion tooling”
The source says No source to compare with.
No source givenGeneralization
The campaign marks an escalation in China-nexus use of AI agents, from single intrusions to multiple simultaneous engagements directed by a human operator.
The article gives no link or citation for it.
The article says “This campaign marks an escalation in China-nexus use of AI agents, from single intrusions to multiple simultaneous engagements directed by a human operator”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 3 pts, not on front page
Recorded for context only, checked 31 Oct 2026, 05:46 UTC. It played no part in the ranking.