CrowdStrike: Vapor Panda ran intrusions with DeepSeek-based agents

CrowdStrike reports that VAPOR PANDA, a China-nexus group, used the ARTEX agent framework, mostly with DeepSeek, to run parallel intrusions starting October 17, 2026. A single controller targeted entities in at least 14 countries over 11 days, with post-exploitation confirmed at nine organizations. A human operator steered agents and told them to find hosts without the Falcon sensor. The figures come from CrowdStrike alone, with no independent sourcing. Defenders should rotate exposed keys and hunt for ARTEX markers.