Vapor Panda Scales ARTEX AI Agents Against 200+ Targets From October 2026

Vapor Panda, tracked since 2021 and overlapping Trend Micro's Earth Estries cluster, deployed Go-based ARTEX with DeepSeek and commercial LLMs. Planner and worker agents handled reconnaissance, lateral movement, and web shell deployment while a human operator intervened for evasion and privilege escalation. Targets spanned foreign ministries in Latin America, Europe, Asia, and the Middle East plus U.S. semiconductor, defense, and telecom entities.

Evidence includes 1.4 billion input tokens consumed in a single intrusion plus recovered transcripts showing SAML assertion chaining, XXE abuse against cloud metadata services, LAPS password reads, and resource-based constrained delegation. Post-exploitation deployed BLOODALCHEMY, a ShadowPad derivative, followed by credential spraying across at least twelve additional organizations.

The pattern reveals agentic tooling extending established access-development missions rather than replacing them. Official attribution rests on CrowdStrike telemetry and TTP overlap; independent technical confirmation of state sponsorship remains limited to infrastructure and malware artifacts. Continued expansion is expected as subscription LLM costs drop.

Next indicators will likely appear in procurement records for endpoint detection bypass testing and increased token usage logs from commercial providers serving Chinese entities.