CrowdStrike tracks a China-backed AI-agent hacking campaign at 200-plus targets as security stocks sell off
CrowdStrike's October 29 report catches a China-backed crew running AI penetration agents against 200-plus organizations, with intrusions confirmed or indicated at about 70 percent of targets. The same week, traders marked the security vendors down on fear that AI cuts software spending; the campaign is a demand signal pointing the other way.
Richard Tang · 3 min read
CrowdStrike−4.08% — CrowdStrike, down 4.08 percent today has documented the first nation-state hacking campaign it has seen run by AI agents at this scale, and the market's answer was to sell the companies that stop such crews. Its October 29 report traces Vapor Panda, a China-backed group CrowdStrike tracks, aiming an AI penetration framework at more than 200 organizations since October 17 12. About 70 percent of them were confirmed compromised or showed signs of intrusion 1. The campaign is still running, and the week's selloff in security stocks prices its consequence exactly backwards 13.
The attacker's cost is now measured in tokens
ARTEX, the framework at the center, is open source: a main agent directs planner and worker agents that pool their findings into a shared graph, running a full intrusion from reconnaissance to data theft 4. Vapor Panda ran it on DeepSeek, the Chinese model, alongside an unidentified commercial one, with a single operator steering at decision points in instructions logged in Chinese 25.
The planning agents burned 1.4 billion input tokens in one intrusion 2. Human crews that CrowdStrike has watched for 15 years peaked near 40 commands an hour 1. This campaign passed 1,500 1.
Endpoint coverage decided who survived
Targets ran from foreign ministries to 19 US pharmaceutical, semiconductor, defense, nuclear and financial companies 2. Earlier in October, Microsoft separately tied the framework to Storm-0940, another China-aligned crew, in the ConnectWise supply-chain breach, so it is already spreading between groups 41. CrowdStrike counted 45 agentic attacks in September 1. It logged 126 in October, and climbing 1. The operator told his agents to find Windows machines without the Falcon sensor, CrowdStrike's endpoint product: visibility is what separated the victims who held from the ones who fell 5.
The selloff and the evidence point opposite ways
On October 28, Fortinet−2.30% — Fortinet, down 2.30 percent today and ServiceNow−3.86% — ServiceNow, down 3.86 percent today cratered after hours despite beating revenue estimates, dragging CrowdStrike, Palo Alto and Zscaler−3.99% — Zscaler, down 3.99 percent today down about 6 percent each on the worry that AI will pull spending away from software 3. CrowdStrike's filings show growth accelerating for five straight quarters 67. Its management says companies are spending more on security because of AI, and Citi's survey of chief information officers found AI deployments driving additional security investment 68.
CrowdStrike's growth has re-accelerated five quarters in a row
Data
| Revenue growth, year over year | |
|---|---|
| Q3 '24 | 28.5% |
| Q4 '24 | 25.2% |
| Q1 '25 | 19.8% |
| Q2 '25 | 21.3% |
| Q3 '25 | 22.2% |
| Q4 '25 | 23.3% |
| Q1 '26 | 25.6% |
| Q2 '26 | 25.8% |
A demand document written at machine speed
The same reporting names four new China-linked groups and a chain through Intapp's+7.95% — Intapp, up 7.95 percent today legal billing software that reached law firms, so the exposure keeps widening 2. CrowdStrike's own read is blunt: nothing here is technically new, only faster, and the defense is visibility into endpoints and identities 1.
That visibility is what the discounted vendors sell, and defending at machine speed is an AI build-out, not a reason to retreat from one. The scarce skill already shows in the transcripts, where the attacker's edge was knowing where to point the machine and reading its output fast enough to steer 5. Traders sold the sector fearing AI shrinks software budgets. The week's best-documented fact is attackers forcing them to grow.
Get Security by email, free
The breaches, flaws and security vendors AI is putting to the test. In our daily email, every weekday.
