Executive Sumamary
CrowdStrike reported a VAPOR PANDA campaign that used ARTEX alongside the Chinese-developed DeepSeek LLM and a second commercial LLM to run intrusions against multiple high-value targets in parallel. Starting 17 October2026, the adversary used ARTEX against more than 200 distinct organizations worldwide, including foreign ministries, semiconductor, defense, and think tank organizations in the U.S., and telecommunications providers. The campaign marks a major escalation in threat actor use of AI agents, from single intrusions to multiple simultaneous engagements directed by a human operator.
This activity is separate from the ARTEX activity that industry sources reported under the Storm-0940 designation.
Targeting
- A single ARTEX controller directed exploitation against entities in at least 14 countries over an 11-day window.
- VAPOR PANDA conducted extensive intrusions at the foreign ministries of two Latin America-based countries, likely compromised a third, and staged target files for foreign ministries in the Central America and Asia regions.
- The adversary also compromised a Middle East-based interior ministry.
- One engagement targeted 19 U.S.-based organizations in the pharmaceutical, semiconductor, defense, nuclear, and financial sectors.
- Telecommunications providers in the U.S., Belgium, and the Philippines were compromised.
- CrowdStrike confirmed post-exploitation activity at nine organizations, where the adversary deployed BLOODALCHEMY and conducted credential spraying, network scanning, and reconnaissance.
Operational Details
VAPOR PANDA ran ARTEX primarily with the Chinese-origin DeepSeek LLM, supplemented by a second subscription-based commercial LLM. In a single intrusion, planning agents consumed roughly 1.4 billion input tokens.
ARTEX coordinates a main agent with subordinate planner and worker agents over a shared graph of facts, findings, and goals, advancing each engagement from initial access through reconnaissance and lateral movement. A human stayed in the loop: transcripts showed an operator issuing instructions in Chinese, timestamped in China Standard Time.
Examples of tradecraft include:
- At a U.S. pharmaceutical organization, the agent chained an unsigned SAML assertion and an XXE flaw to query the cloud Instance Metadata Service, then escalated to recover an enterprise administrator account.
- At a second U.S. pharmaceutical organization, the agent deployed web shells, abused an unauthenticated orchestration service for root access, read LAPS passwords, and abused resource-based constrained delegation.
- Against a Greek government entity, the agent used unrotated keys from a 2022 directory export to forge an administrator token and read mailboxes, then used recovered VPN configurations to reach the internal network.
The agents pursued multiple attack paths in parallel and shifted to alternatives when one failed.
Endpoint Sensor Evasion
At a global pharmaceutical organization, the operator told the agents to find Windows machines in the domain without Falcon, using PRC red-team slang for the CrowdStrike Falcon sensor. This lets the adversary concentrate follow-on activity on unprotected hosts.
BLOODALCHEMY Backdoor
At a Middle East-based interior ministry and a Latin America-based foreign ministry, VAPOR PANDA deployed BLOODALCHEMY, a backdoor first publicly documented in October 2023. 1 A legitimate GameHook binary renamed svchost.exe loaded a malicious DLL, graphics-hook-filter64.dll, which decrypted the payload file graphics-hook_config.bin. 1 The implant carries an internal project path, D:\ProjectX\Merman_New.
C2 domains include nginxmysql[.]com, sqlserver-sqlite[.]com, and www[.]ddduuuppp[.]com.
Assessment
- Since 2021, VAPOR PANDA has primarily targeted government, think tank, energy, and extractive organizations across Europe, North America, Oceania, and the UK to develop long-term access.
- China-nexus adversaries will highly likely keep adopting agentic frameworks such as ARTEX over the next 12 months, pairing them with commercial LLMs.
Mitigation Options
- Rotate signing keys, preauthentication keys, and service credentials after any suspected data exposure, including keys in historical backups and directory exports.
- Enforce SAML signature validation, require IMDSv2, and restrict cloud roles’ command-execution permissions.
- Hunt for ARTEX markers such as artx or artex command-line strings, artx-prefixed cloud roles, and the C:\ProgramData\artx5v\ directory.
- Patch internet-facing appliances, particularly long-lived Linux-based servers.
- Deploy an advanced, real-time EDR agent across the environment, including on servers considered inaccessible from the internet.
