Global – October 31, 2026 -- The China-nexus adversary VAPOR PANDA used the agentic framework ARTEX to target more than 200 organizations worldwide, according to CrowdStrike OverWatch. The campaign paired the Chinese-developed DeepSeek large language model (LLM) with a second commercial LLM to run intrusions against multiple high-value targets in parallel. CrowdStrike calls it an escalation in China-nexus use of AI agents, from single intrusions to simultaneous engagements directed by one human operator.
Campaign reached at least 14 countries in 11 days
Exploitation activity began on October 17, 2026, from a single ARTEX controller linked to VAPOR PANDA infrastructure. Targets included foreign ministries in Latin America, Europe, Asia and the Middle East. U.S. semiconductor, defense and think tank organizations were also hit, along with telecommunications providers in multiple regions.
The controller intermittently exposed adversary tooling, target files and agent transcripts, which showed multiple engagements, called "tasks" by ARTEX, against multiple targets.
CrowdStrike reported these specifics:
- Extensive intrusions at the foreign ministries of two Latin American countries, a likely compromise of a third, and staged files for use against foreign ministries in Central America and Asia.
- A compromised Middle East-based interior ministry.
- One engagement against a single European country, covering its foreign ministry, presidency, prime minister's office, and defense, justice, finance and intelligence entities.
- A separate engagement against 19 U.S. organizations in pharmaceuticals, semiconductors, defense, nuclear and finance.
- Compromised telecommunications providers in the U.S., Belgium and the Philippines.
CrowdStrike Intelligence confirmed post-exploitation activity at nine organizations. There, the adversary gained access, deployed the BLOODALCHEMY backdoor, and conducted credential spraying, network scanning and reconnaissance. It also ran password-spraying and credential-scanning against at least 12 more organizations, including U.S. think tanks and European government entities.
Operator steers parallel AI agents from China Standard Time
VAPOR PANDA ran ARTEX mainly on DeepSeek, supplemented by a subscription-based commercial LLM that CrowdStrike could not identify. In a single intrusion, its planning agents consumed roughly 1.4 billion input tokens, implying far higher usage across the whole operation.
ARTEX coordinates a main agent with subordinate planner and worker agents over a shared graph of facts, findings and goals. Recovered transcripts show an operator issuing instructions in Chinese, labeled as human instructions and timestamped in China Standard Time. The operator directed agents to write web shells, extract domain administrator passwords and inventory endpoint sensor coverage.
The agents pursued attack paths across web applications, cloud services, container environments, Active Directory, and mail and VPN infrastructure, and switched approaches when one failed. CrowdStrike said this lets one operator apply more techniques against more targets than manual operations would allow.
Agents chained known flaws to reach administrator access at two U.S. drugmakers
At one U.S. pharmaceutical organization, the agent chained an unsigned SAML assertion with an XML external entity flaw to query the cloud Instance Metadata Service. That yielded a role able to issue administration commands to thousands of instances, and the agent then escalated to an enterprise administrator account.
At a second U.S. pharmaceutical organization, the agent deployed web shells and abused an unauthenticated orchestration service to gain root access in a production container environment. It then read Local Administrator Password Solution passwords and abused resource-based constrained delegation to impersonate a privileged account.
Against a Greek government entity, the operator supplied a 2022 directory export from the organization's mail server containing authentication keys that had likely not been rotated. The agent forged an administrator token and read mailboxes. It then used VPN configurations from a user's sent mail, plus a VPN client key the operator tied to a May 2024 email leak, to enter the internal network.
Operator told agents to hunt Windows hosts lacking the Falcon sensor
At a global pharmaceutical organization, the operator instructed the agents to find Windows machines in the domain without Falcon, judging by task lists and folder listings. The Chinese term used for Falcon is PRC red-team slang for the CrowdStrike sensor. Building sensor checks into the agent workflow lets the adversary concentrate follow-on activity on unprotected hosts.
BLOODALCHEMY backdoor loaded through a renamed GameHook binary
At the Middle East interior ministry and a Latin American foreign ministry, VAPOR PANDA deployed BLOODALCHEMY, first publicly documented in October 2023. A legitimate GameHook binary renamed svchost.exe loaded a malicious DLL, graphics-hook-filter64.dll, which decrypted the payload file graphics-hook_config.bin. Copies of all three files sat in exposed open directories. The implant carries the internal project path D:\ProjectX\Merman_New\.
CrowdStrike Falcon telemetry revealed BLOODALCHEMY deployment and command-and-control infrastructure absent from public ARTEX reporting.
CrowdStrike expects wider China-nexus adoption of agentic frameworks within 12 months
CrowdStrike separates the campaign from ARTEX activity reported by industry sources under the Storm-0940 designation, which likely shows the framework is gaining popularity among multiple China-nexus adversaries. Since 2021, VAPOR PANDA has mainly targeted government, think tank, energy and extractive organizations across Europe, North America, Oceania and the UK to develop long-term access. This is its first observed use of AI-driven intrusion tooling, alongside a broadening into pharmaceutical, semiconductor, nuclear and defense targets.
CrowdStrike assesses that China-nexus adversaries will highly likely keep adopting agentic frameworks like ARTEX over the next 12 months, pairing them with commercially available LLMs. Its recommended defenses include:
- Rotating signing keys, preauthentication keys and service credentials after any suspected data exposure, including keys in historical backups and directory exports.
- Enforcing SAML signature validation and requiring IMDSv2.
- Hunting for ARTEX markers, including the C:\ProgramData\artx5v\ directory.
- Patching internet-facing appliances.
- Deploying real-time endpoint detection and response across all servers, including those considered inaccessible from the public internet.