Quick links
Press Enter to search, Esc to close
Threat group profile
CrowdStrike tracks VAPOR PANDA as a China-based, state-sponsored targeted intrusion adversary and first saw it in February 2021. From 17 October 2026, CrowdStrike says, the group used the ARTEX agentic AI framework against more than 200 targets.
In short
CrowdStrike tracks VAPOR PANDA as a China-based, state-sponsored targeted intrusion adversary and first saw it in February 2021. From 17 October 2026, CrowdStrike says, the group used the ARTEX agentic AI framework against more than 200 targets.
CrowdStrike's account of the 2026 campaign shows how the group put AI agents to work. A main ARTEX agent directed planner and worker agents, which tried web, cloud, container, directory, mail and VPN paths at the same time. An operator steered them in Chinese at decision points. In one intrusion the planning agents used on the order of 1.4 billion input tokens.
Our news report on the VAPOR PANDA ARTEX espionage campaign walks through three of the intrusions. It also lists all nine indicators CrowdStrike published, including the file hashes.
Public reports use several names for this activity.
| Name | Where it appears |
|---|---|
| VAPOR PANDA | CrowdStrike name, used on its adversary page and in its report of 29 October 2026[1, 2] |
Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.
CrowdStrike Page updated 30 October 2026
Describes VAPOR PANDA as a China-based targeted intrusion adversary whose motive it lists as state-sponsored. Gives its aims as intelligence gathering and theft of intellectual property.[1]
CrowdStrike Page updated 30 October 2026
Says it first saw the group in February 2021, when it used the ProxyLogon flaws. Says it first tracked the group under the VexatiousTemper cluster.[1]
CrowdStrike 29 October 2026
Linked the ARTEX controller behind the October 2026 campaign to VAPOR PANDA servers. Called the campaign a step up in China-nexus use of AI agents.[2]
CrowdStrike 29 October 2026
Says the BLOODALCHEMY backdoor used in the campaign talked to VAPOR PANDA servers.[2]
CrowdStrike 29 October 2026
Says the campaign is separate from the ARTEX activity reported under the name Storm-0940. Microsoft calls Storm-0940 a China-state aligned actor.[2, 7]
Elastic Security Labs 4 and 13 October 2023
Placed BLOODALCHEMY in its REF5961 intrusion set and called the people behind it state-sponsored, spying and China-nexus. It did not use the name VAPOR PANDA.[3, 4]
Only CrowdStrike names VAPOR PANDA. No government text or MITRE ATT&CK group page we reviewed uses the name.
CrowdStrike lists Earth Estries, a Trend Micro name, as a community identifier for VAPOR PANDA. Trend Micro's own report of 25 November 2024 writes "Earth Estries (aka Salt Typhoon, FamousSparrow, GhostEmperor and UNC2286)".
The same report says it can only confirm that some Earth Estries methods overlap with FamousSparrow and GhostEmperor. CrowdStrike lists Salt Typhoon and GhostEmperor under a different name, OPERATOR PANDA, and MITRE ATT&CK links Salt Typhoon to OPERATOR PANDA too. Because the naming sources do not agree, we do not list Earth Estries as an alias here.
Elastic Security Labs placed BLOODALCHEMY in its REF5961 intrusion set in October 2023. CrowdStrike cites that work but does not say whether REF5961 and VAPOR PANDA are the same actor.
Each entry is attributed to the group by the sources cited.
CrowdStrike says it first saw VAPOR PANDA when the group used the ProxyLogon chain (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065).[1]
CISA issued alert AA21-062A on the four Microsoft Exchange flaws and urged patching. The alert does not name VAPOR PANDA.[8]
Per CrowdStrike, the group mainly hits government, think tank, energy and extractive targets in Europe, North America, Oceania and the UK.[2]
Elastic Security Labs described the REF5961 intrusion set at the foreign ministry of an ASEAN member state. On 11 October it linked the set to BLOODALCHEMY.[4]
A single ARTEX controller linked to VAPOR PANDA infrastructure targeted entities in at least 14 countries over an 11-day window, per CrowdStrike.[2]
CrowdStrike confirmed post-exploitation at nine targets, where the group deployed BLOODALCHEMY. It saw password spraying at 12 or more others.[2]
CrowdStrike published its account of the campaign, with agent transcripts, an ATT&CK mapping and indicators.[2]
Techniques reported for this group, by MITRE ATT&CK tactic.
Unsecured Credentials: Cloud Instance Metadata API T1552.005
Queried the cloud metadata service through an XXE flaw to obtain cloud role credentials.[2]
Forge Web Credentials: SAML Tokens T1606.002
Submitted unsigned SAML assertions.[2]
Brute Force: Password Spraying T1110.003
Password-sprayed government, think tank and corporate accounts.[2]
ARTEX Agentic AI intrusion framework
Open-source framework whose main, planner and worker agents ran several engagements at once in the October 2026 campaign.[2, 7]
BLOODALCHEMY Backdoor
x86 backdoor written in C that runs as shellcode in a signed benign process, deployed at a Middle East interior ministry and a Latin American foreign ministry (2026).[2, 3]
graphics-hook-filter64.dll Loader
Malicious DLL that decrypts the BLOODALCHEMY payload file graphics-hook_config.bin (2026).[2]
GameHook Legitimate binary
Legitimate program renamed svchost.exe to load the BLOODALCHEMY loader DLL (2026).[2]
DeepSeek Large language model
Chinese-origin model that ran most of the ARTEX work, alongside a second commercial model CrowdStrike could not confirm (2026).[2]
Chisel Tunneling tool
Used to tunnel traffic during the October 2026 campaign.[2]
SoftEther VPN software
Used to tunnel traffic during the October 2026 campaign.[2]
JSP and PHP web shells Web shell
Written by the agents on compromised servers to keep access (2026).[2]
Restrict the command-execution permissions of cloud roles to the minimum required instances.
Counters T1651
Search for command lines containing artx or artex, artx-prefixed cloud roles, art18- comments on administration commands and the folder C:\ProgramData\artx5v\.
Counters T1588.007
Patch internet-facing appliances, especially long-lived Linux servers, as CrowdStrike advises. Keep on-premises Exchange fixed for the four ProxyLogon flaws, as CISA urged in March 2021.
Counters T1190
Follow reports on VAPOR PANDA and other China-nexus groups, and get an alert when your sector or country is named.
Find internet-facing mail, VPN and appliance hosts and check which versions they run, so patching starts with them.
Watch for leaked company passwords, mail exports and VPN files, the kind of data the operator handed to the agents.
It is CrowdStrike's name for a China-based, state-backed spying group. CrowdStrike first saw it in February 2021, when it used the ProxyLogon flaws. No government names the group in the sources we read.
From 17 October 2026 it used the ARTEX agentic AI framework against more than 200 targets in at least 14 countries, per CrowdStrike. CrowdStrike confirmed post-exploitation at nine of them. Targets included foreign ministries, a Middle East interior ministry, US pharmaceutical and semiconductor firms, and telecoms.
Sources differ. CrowdStrike lists Earth Estries as a community identifier for VAPOR PANDA. Trend Micro, which coined Earth Estries, links that name to Salt Typhoon, FamousSparrow, GhostEmperor and UNC2286, while CrowdStrike puts Salt Typhoon and GhostEmperor under its OPERATOR PANDA name.
Elastic Security Labs first documented it in October 2023 as an x86 backdoor written in C. VAPOR PANDA loaded it through a renamed GameHook binary and a malicious DLL, per CrowdStrike. Elastic ties it to its REF5961 intrusion set, which CrowdStrike does not equate with VAPOR PANDA.
Rotate keys and service passwords after any data leak. Enforce SAML signature checks and IMDSv2, and patch exposed servers. Run EDR on every host, including internal servers. Then hunt for ARTEX markers and block the BLOODALCHEMY domains and IP addresses CrowdStrike published.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.
