VAPOR PANDA initiated a global espionage campaign starting October 17, 2026, leveraging the AI-driven ARTEX framework along with DeepSeek and commercial large language models to conduct simultaneous intrusions against over 200 organizations worldwide. Targets included foreign ministries in Latin America, Europe, Asia, and the Middle East, as well as U.S. semiconductor, defense, pharmaceutical, nuclear, and telecommunications sectors. The adversary deployed the BLOODALCHEMY backdoor, performed credential spraying, and directed AI agents to identify systems lacking endpoint security sensors. This campaign marks a shift from single intrusions to multiple autonomous attack paths coordinated by AI agents under human strategic guidance in Chinese. It highlights the use of open-source AI combined with commercial LLMs to scale intrusion operations beyond manual capabilities.
