AI agents just ran a hacking campaign against 200 organizations. What it means for your office

What happened

On Oct. 29, CrowdStrike published a report on a group it calls VAPOR PANDA. Starting Oct. 17, the group used an AI agent framework called ARTEX against more than 200 distinct organizations worldwide. One controller went after targets in at least 14 countries over 11 days.

ARTEX isn't one chatbot. CrowdStrike describes a main agent that hands work to planner and worker agents, all sharing a running list of facts and goals. It ran mainly on DeepSeek, a Chinese AI model, plus a second paid model CrowdStrike couldn't identify. In a single break-in, the planning agents used roughly 1.4 billion input tokens. That's a lot of AI reading, aimed at one target.

The results were smaller than the headline number. CrowdStrike confirmed the attackers got in and did follow-on work at nine organizations. It saw password spraying and credential scanning at at least 12 more. The named targets were mostly foreign ministries, semiconductor and defense firms, and think tanks.

This wasn't the first sighting. On Oct. 22, Infosecurity Magazine reported that Microsoft said a group it tracks as Storm-0940 used ARTEX against hundreds of organizations starting in September, as reported by Infosecurity Magazine. That campaign went through Microsoft 365 tenants used by ConnectWise, an IT management software company. ConnectWise took several cloud services offline, including its Cloud Backup product, and told customers to check their own Microsoft 365 tenants for unauthorized changes. Per that report, the attackers tried to sign in to more than 2,250 tenants at 2,900 sign-in attempts per minute.

What's actually new

Not the tricks. Adam Meyers, who runs CrowdStrike's counter-adversary team, told CyberScoop the attacks aren't showing anything new. The difference is speed and scale. He said hands-on hacking that CrowdStrike tracked over 15 years usually ran up to 40 commands an hour. With ARTEX, he said, it could top 1,500. That's his estimate, not a measured average.

The other change is cost. Spread across 200 targets, Meyers said, a mass campaign costs the attackers very little. And the count is rising. CrowdStrike saw roughly 45 attacks by AI-agent adversaries in September, and 126 in October as of CyberScoop's Oct. 30 report.

Attacks by AI-agent adversaries seen by CrowdStrike

Count per month, as told to CyberScoop. October is partial, through about Oct. 30.

1. September 2026~45
2. October 2026so far126

Source: CyberScoop, Oct. 30, 2026 (CrowdStrike's Adam Meyers).

Where the skeptics have a point

Read the numbers carefully. A security analyst, P.K. Sharma, put it simply: "The 200 is a reach figure, not a breach count." He also notes that CrowdStrike sells security products, and that its post ends by recommending its own. Even CyberScoop's headline says 140 sensitive targets were compromised, far more than the nine break-ins CrowdStrike's own post confirms.

"AI-driven" also doesn't mean "no humans." CrowdStrike says the framework kept a person in the loop. Recovered transcripts showed an operator giving the agents instructions. And CrowdStrike itself says this is a group doing the same job at wider scale, not a whole new kind of attack.

So don't panic. Most 100-person manufacturers aren't on a foreign ministry's threat list. But the second story, ConnectWise, is the one that should get your attention. Its customers weren't targets because of who they were. They were reached because of a vendor they trusted.

The tricks aren't new. They just got cheap enough to try on everyone.

What changes for a mid-size office

• "We're too small to bother with" gets weaker. When trying another target costs almost nothing, attackers don't need to pick carefully.
• Old credentials matter more. In one case, CrowdStrike says the attackers used a 2022 mail-server export with keys that likely had never been rotated. Every company has some version of that: a former employee's account, a shared login, a service password set up years ago.
• Your vendors' access is your access. Backup tools, remote-management tools and security tools often hold admin rights in your Microsoft 365. If one of them is breached, so are you.

What doesn't change

• The defenses are the same basics. CrowdStrike's own advice is to rotate keys and service passwords after any suspected exposure, including keys sitting in old backups and exports, and to patch internet-facing devices.
• Password spraying still loses to strong sign-in rules. Spraying works by guessing common passwords across many accounts. Accounts with multifactor sign-in are much harder to get into that way.
• This isn't a reason to stop using AI in your business. It's a reason to set up any AI tool the way you'd set up a new employee: its own login, only the access it needs, and a person checking its work.

Five checks to run this month

None of this is new advice, which is the point. The ARTEX reports don't ask you to buy anything. They ask you to finish the list you already have, because finding the gaps is now cheap for the other side.

If you're adding AI tools to your office, the same rules apply to them. We wrote about the questions to ask in is AI safe for customer and order data, and why a person should approve every step until the numbers say otherwise.