Evidence · DiggingBeagle record
CrowdStrike: VAPOR PANDA used ARTEX in multi-target intrusion campaign
CrowdStrike telemetry of an operator-controlled ARTEX campaign, with distinct target versus verified post-exploitation populations.
- Published
- Oct 29, 2026
- Source role
- primary disclosure
Evidence record
CrowdStrike telemetry of an operator-controlled ARTEX campaign, with distinct target versus verified post-exploitation populations.
Claim-level citations (2)
- supportsVAPOR PANDA used ARTEX agents in parallel intrusions; nine organizations had confirmed post-exploitation: CrowdStrike reported ARTEX-driven activity against over two hundred organizations and confirmed post-exploitation at nine; those two figures describe different populations.
CrowdStrike article, Targeting and Inside the Operation sections, 200+ target and nine confirmed counts
- supportsVAPOR PANDA used ARTEX agents in parallel intrusions; nine organizations had confirmed post-exploitation: The investigated campaign included distinct cloud identity, orchestration/credential and historical key-reuse attack paths, coordinated by a human operator and ARTEX tooling.
CrowdStrike article, incident examples and human/ARTEX command structure