The China-nexus hacking group VAPOR PANDA used an AI agent framework to target more than 200 organizations worldwide within eleven days, according to CrowdStrike. The security company describes the campaign in a report published on October 29, 2026. What stands out is less any single technique than the operating model: one human operator steered several intrusions in parallel while AI agents did much of the work. CrowdStrike says the framework ran primarily on the Chinese DeepSeek language model.
All details in this article come from CrowdStrike’s report. The attribution to VAPOR PANDA is the company’s assessment and has not been independently confirmed.
Key Takeaways
- Starting October 17, 2026, VAPOR PANDA used the ARTEX framework against more than 200 organizations in at least 14 countries, including foreign ministries, defense, semiconductor and pharmaceutical companies and telecom providers, CrowdStrike says.
- Post-exploitation activity was confirmed at nine organizations, with password spraying and scanning against at least twelve more.
- ARTEX ran mainly on DeepSeek, supplemented by a second commercial LLM that CrowdStrike could not identify.
- The operator told the agents to look specifically for Windows machines without the CrowdStrike Falcon sensor.
- CrowdStrike recommends rotating keys after any data exposure, enforcing SAML signature validation and requiring IMDSv2, among other steps.
What is known about the VAPOR PANDA campaign
CrowdStrike OverWatch says it observed the activity from October 17, 2026, via a single ARTEX controller that CrowdStrike Intelligence links to VAPOR PANDA infrastructure. The controller intermittently exposed tooling, target files and agent transcripts, which showed multiple “tasks”, as ARTEX calls individual engagements, running in parallel against different targets.
The target list is broad. VAPOR PANDA reportedly carried out extensive intrusions at the foreign ministries of two Latin American countries, likely compromised a third, and staged target files for foreign ministries in Central America and Asia. A Middle East interior ministry was compromised. One engagement focused on a single European country, targeting its foreign ministry, presidency and prime minister’s office as well as defense, justice, finance and intelligence entities; CrowdStrike does not name the country. Another engagement targeted 19 US organizations in the pharmaceutical, semiconductor, defense, nuclear and financial sectors. Telecom providers in the US, Belgium and the Philippines were also compromised.
CrowdStrike confirmed post-exploitation activity at nine organizations, where the attackers gained access, deployed the BLOODALCHEMY backdoor and followed up with credential spraying, network scanning and reconnaissance. At least twelve more organizations, including US think tanks and European government entities, faced password spraying and credential scanning.
How ARTEX works
According to CrowdStrike, ARTEX coordinates a main agent with subordinate planner and worker agents over a shared graph of facts, findings and goals, advancing each engagement from initial access through host reconnaissance to lateral movement. The framework layers open source components on top of commercial LLM subscriptions, which CrowdStrike sees as an example of how scalable multi-agent intrusions can be assembled largely from public building blocks.
A human stayed in the loop. Recovered transcripts show an operator issuing instructions in Chinese, labeled as “human instruction” and timestamped in China Standard Time, directing the agents to write web shells, extract domain administrator passwords and inventory endpoint sensor coverage. CrowdStrike says the operator only intervened at decision points while the agents ran several engagements at once. In a single intrusion, the planning agents consumed on the order of 1.4 billion input tokens.
For context, ARTEX itself is not new. CrowdStrike says it has previously seen the framework used by financially motivated and unattributed actors. Microsoft reported ARTEX activity under the Storm-0940 designation on October 21; CrowdStrike stresses that this campaign is separate. We covered ARTEX attacks on South Korean banks in our article on the AI cyberattack wave against banks.
Known techniques, new pace
The examples in the report show the agents mostly chaining well-established techniques:
- At a US pharmaceutical company, an agent combined an unsigned SAML assertion with an XXE flaw to query the cloud Instance Metadata Service, obtaining a role that could issue administration commands to thousands of instances, and escalated to an enterprise administrator account.
- At a second pharmaceutical company, an agent deployed web shells, abused an unauthenticated orchestration service to get root in a production container environment, read LAPS passwords and abused resource-based constrained delegation to impersonate a privileged account.
- Against a Greek government entity, the operator supplied a 2022 directory export from the mail server containing authentication keys that had likely never been rotated. The agent forged an administrator token, read mailboxes and used VPN configurations from a user’s sent mail to reach the internal network.
CrowdStrike says the agents pursued multiple attack paths in parallel, across web applications, cloud services, containers, Active Directory and mail and VPN infrastructure, and switched approaches when one failed. That likely lets a single operator apply more techniques against more targets than manual work would allow. We saw a similar pattern with a lone attacker in our report on AI agent hacking.
Hunting for unprotected machines
One detail concerns CrowdStrike directly. At a global pharmaceutical company, the operator told the agents to find Windows machines in the domain without “falcon”, judging by process lists and folder listings. According to CrowdStrike, “falcon” is Chinese red-team slang for its Falcon sensor. Checking sensor coverage was thus built into the agent workflow, letting the attackers focus on unprotected hosts.
This passage deserves some distance: it comes from a vendor that sells endpoint protection, and the report ends with a recommendation for its own product. The broader lesson holds regardless: machines without an EDR agent, whether “unimportant” servers or forgotten systems, are prime targets for automated attackers.
BLOODALCHEMY and indicators
At a Middle East interior ministry and a Latin American foreign ministry, VAPOR PANDA deployed BLOODALCHEMY, a backdoor first publicly documented in October 2023. The attackers used a legitimate GameHook binary renamed svchost.exe to load a malicious DLL, graphics-hook-filter64.dll, which decrypted the payload. CrowdStrike publishes command-and-control domains, IP addresses and file hashes. To hunt for ARTEX itself, it lists command-line parameters containing “artx” or “artex”, artx-prefixed cloud roles and the C:\ProgramData\artx5v\ directory.
What security teams should do now
CrowdStrike’s recommendations can be applied without Falcon:
- Rotate signing keys, preauthentication keys and service credentials after any suspected data exposure, including keys sitting in old backups and directory exports.
- Enforce SAML signature validation, require IMDSv2 and restrict cloud roles with command-execution rights to as few instances as possible.
- Hunt for the ARTEX markers and the published indicators.
- Patch internet-facing appliances, especially long-lived Linux servers.
- Deploy EDR coverage across the environment, including servers considered unreachable from the internet.
The Greek case shows why old leaks stay dangerous: a 2022 export was enough because the keys in it had never been replaced.
Analysis
CrowdStrike calls the campaign an escalation, from AI assisting single intrusions to multiple simultaneous engagements that a human merely directs. It is VAPOR PANDA’s first observed use of AI-driven intrusion tooling and a notable expansion into new sectors and regions, the company says, and it considers it highly likely that China-nexus actors will keep adopting such frameworks over the next twelve months.
Whether the figure of more than 200 organizations covers targeted attacks only or also broad scanning cannot be read in detail from the report; nine compromises are confirmed. What is clear is that AI agents lower the cost of parallel, persistent attacks, and defenders should expect known weaknesses to be exploited faster and on a wider front. The full report, including all indicators, is on the CrowdStrike blog.
