CrowdStrike and Microsoft: state hackers go agentic — China's VAPOR PANDA hit 200+ orgs in 11 days with ARTEX + DeepSeek; North Korea has operationalized AI

Why it matters

On 2026-10-29 two vendors published state-actor AI reports converging on the open-source agentic pentest framework ARTEX. CrowdStrike says China-nexus VAPOR PANDA used a single ARTEX controller, mainly on DeepSeek plus an unidentified commercial LLM, against 200+ organizations in 14+ countries over 11 days from Oct 17 — foreign ministries, US semiconductor/defense/pharma/nuclear/finance firms, think tanks and telecoms — with 9 confirmed compromises (BLOODALCHEMY backdoor) and ~1.4B input tokens in one intrusion; a Chinese-speaking operator steered key steps. Microsoft Threat Intelligence rated North Korean AI adoption as high: Jade, Coral and Jasper Sleet have operationalized AI; Onyx Sleet mass-produced 100+ lures in minutes; Onyx and Pearl Sleet began using ARTEX in late October. Both stress operations remain human-directed. Follows Storm-0940 (e/1031) and CrowdStrike's first ARTEX report (e/734).