Vapor Panda targeted Latin American ministries

CrowdStrike observed a single ARTEX controller used for 11 days against more than 200 organizations in at least 14 countries, in a campaign attributed to Vapor Panda. The technical analysis also identifies ARTEX used alongside DeepSeek and another commercial model, and describes parallel intrusions against high-value targets.

What is known about the scope of the campaign?

The operation had a clear scale in both time and volume, with activity sustained for 11 days and reaching more than 200 organizations, according to Cybersecurity Dive and CrowdStrike's published analysis. The technical source adds that the pattern was not isolated, but part of a parallel execution against high-value targets.

That deployment matters because it points to a coordinated, repeated campaign rather than a one-off incident. The combination of ARTEX with DeepSeek and another commercial model was part of the technical framework CrowdStrike described to automate and scale the activity.

What happened in Latin America?

According to ITBrief Asia, Vapor Panda carried out intrusions against foreign ministries in two Latin American countries and likely compromised a third. The available source does not identify the affected countries, so it is not possible to go beyond that attribution.

A separate secondary report also said at least nine organizations were compromised during the operation, in addition to the targets that were probed. That data, however, does not include a verifiable breakdown by country or sector, so it does not allow a reliable reconstruction of how far each front of the campaign reached.

What can be stated with technical confidence?

The strongest point in the case is CrowdStrike's finding on the use of ARTEX as a single controller for 11 days, alongside AI models used to sustain the campaign. That combination suggests an operation built to increase speed and volume, but the public material leaves gaps about the countries, the agencies and the exact extent of the compromises.

At the regional level, ESET added that FamousSparrow maintained monitoring activity in South America between April and September 2026, although the available report does not specify countries, organizations or concrete intrusions. Based on the sources provided, the regional map is still drawn from partial attributions and an incomplete level of detail.