Agentic intrusion tooling turns up on three continents at once [Oct 30 2026]

The AI Edge · Oct 30, 2026 · 14m

CrowdStrike says that beginning on October 17, 2026 it watched a single ARTEX controller linked to the China-nexus group VAPOR PANDA attack more than 200 distinct organizations in at least 14 countries over an 11-day window, running the open-source agent framework primarily on the Chinese-origin DeepSeek LLM and burning "on the order of 1.4 billion input tokens" of planning in one intrusion. Microsoft Threat Intelligence published the same day, assessing AI adoption across North Korean threat actors as "high" and reporting Onyx Sleet and Pearl Sleet using ARTEX since late October 2026. Epoch…