VAPOR PANDA and ARTEX: How AI Agents Ran a China-Nexus Espionage Campaign

On 29 October 2026, CrowdStrike reported that VAPOR PANDA, a China-nexus espionage adversary, used the ARTEX agentic AI framework to run intrusions against many targets at once. From 17 October, one ARTEX controller went after more than 200 organizations in at least 14 countries over 11 days. CrowdStrike confirmed post-exploitation activity at nine of them.

CrowdStrike says this campaign is separate from the ARTEX activity Microsoft tied to Storm-0940 in the ConnectWise supply chain attack. It is also the first time CrowdStrike has seen this adversary use AI-driven intrusion tooling. Below we walk through how the operation ran, what the agents did inside three networks, and what defenders can hunt for.

Who Is VAPOR PANDA and What Did CrowdStrike See?

VAPOR PANDA is CrowdStrike’s name for a China-nexus adversary. Since 2021 it has mainly targeted government, think tank, energy and extractive organizations in Europe, North America, Oceania and the UK. Its aim has been long-term access, a classic cyber espionage mission.

CrowdStrike OverWatch found the campaign through a single ARTEX controller that CrowdStrike Intelligence linked to VAPOR PANDA infrastructure. The controller intermittently exposed the adversary’s tooling, target files and agent transcripts. Those exposures give the report an unusual inside view of how the agents worked.

Which Governments and Sectors Were Targeted?

The targets were mostly state bodies and strategic industries. CrowdStrike says VAPOR PANDA ran extensive intrusions at the foreign ministries of two Latin American countries and likely compromised a third. It also compromised an interior ministry in the Middle East. Staged target files point to planned work against foreign ministries in Central America and Asia.

One engagement focused on a single European country. It covered the foreign ministry, the presidency and the prime minister’s office, plus defense, justice, finance and intelligence bodies. Another engagement targeted 19 US organizations in the pharmaceutical, semiconductor, defense, nuclear and financial sectors. The adversary also compromised telecommunications providers in the US, Belgium and the Philippines.

How many targets were breached depends on the source. The blog confirms post-exploitation at nine organizations, where VAPOR PANDA deployed BLOODALCHEMY, sprayed credentials and scanned networks. CrowdStrike told CyberScoop that about 70% of targets were confirmed compromised or showed moderate-confidence evidence of intrusion. CyberScoop’s headline puts that at about 140 targets.

How Did One Operator Run Parallel Intrusions With ARTEX?

ARTEX runs a main agent that directs planner and worker agents. They share a graph of facts, findings and goals, and push each engagement from initial access through host reconnaissance to lateral movement. ARTEX calls each engagement a “task”, and VAPOR PANDA ran several tasks at the same time.

The adversary ran ARTEX mainly on DeepSeek, with a second subscription-based LLM that CrowdStrike could not confirm. In a single intrusion, the planning agents consumed on the order of 1.4 billion input tokens. CrowdStrike reads that as a sign of far higher use across the whole operation.

A human stayed in the loop. Recovered transcripts show an operator writing in Chinese under the label 【人类指令】 (“human instruction”), with China Standard Time timestamps. The operator told the agents to write web shells, extract domain administrator passwords and inventory endpoint sensor coverage.

Speed is the real change. CyberScoop reports that hands-on-keyboard activity tracked by CrowdStrike typically ran at up to 40 commands an hour. “Now, with ARTEX, we could see it exceed 1,500 commands an hour,” CrowdStrike’s Adam Meyers told CyberScoop. CyberScoop adds that CrowdStrike counted about 45 agentic adversary attacks in September and 126 so far in October.

The framework is easy to get. Microsoft describes ARTEX as open source, and a GitHub search on 31 October returned 62 repositories for “ARTEX agentic”. Of the 30 listed first, 29 were created in October 2026.

In Brandefense Blackhole, 52 posts on Telegram, Discord and forum channels mentioned ARTEX between 17 and 30 October. Most reshared news. Posts peaked on 22 October, the day after Microsoft’s report, and again on 30 October. A few shared links to public copies of the code.

What Did the Agents Do Inside Three Networks?

The transcripts pair AI-driven workflow with well-known tradecraft. The agents tried several attack paths at once and moved on when one failed. Three engagements stand out in CrowdStrike’s account.

A US pharmaceutical organization. The agent chained an unsigned SAML assertion with an XML external entity (XXE) flaw to query the cloud Instance Metadata Service. That gave it a role able to issue administration commands to thousands of instances. It then escalated to an enterprise administrator account.

A second US pharmaceutical organization. The agent deployed web shells and abused an unauthenticated orchestration service to get root in a production container environment. It read Local Administrator Password Solution (LAPS) passwords. It then abused resource-based constrained delegation to impersonate a privileged account.

A Greek government entity. The operator handed the agent a 2022 directory export from the organization’s mail server. Its authentication keys had likely not been rotated since then, so the agent forged an administrator token and read mailboxes. VPN settings from a user’s sent mail, plus a VPN client key the operator tied to a May 2024 email leak, opened the internal network.

The operator also built sensor evasion into the workflow. At a global pharmaceutical organization, the agents were told to find Windows machines in the domain without “猎鹰” (Falcon), judging by tasklist and folder listings. CrowdStrike says 猎鹰 is Chinese red-team slang for its Falcon sensor. Follow-on work could then focus on hosts with no protection.

Where Does BLOODALCHEMY Fit In?

At a Middle East interior ministry and a Latin American foreign ministry, VAPOR PANDA deployed BLOODALCHEMY. Elastic Security Labs first documented this backdoor in October 2023 as part of the REF5961 intrusion set. Elastic describes it as an x86 backdoor written in C that runs as shellcode injected into a signed, benign process.

The loading chain starts with a legitimate GameHook binary renamed svchost.exe. It loads a malicious DLL, graphics-hook-filter64.dll, which decrypts the payload file graphics-hook_config.bin. The implant carries the project path D:\ProjectX\Merman_New\, likely an in-house development name. CrowdStrike says these indicators had not appeared in earlier public ARTEX reporting.

How the Campaign Maps to MITRE ATT&CK

CrowdStrike maps the activity to 18 ATT&CK techniques. The strip below groups the main ones by tactic. CrowdStrike also lists T1588.007, Obtain Capabilities: Artificial Intelligence, for the use of ARTEX itself, and T1114.002 for reading mailboxes.

For command and control, CrowdStrike saw traffic routed through Tor, SOCKS proxies and a compromised relay, and tunnels built with Chisel and SoftEther.

What Should Defenders Hunt For?

The first five steps below are CrowdStrike’s recommendations, in the order a team can act on them. The last one is ours, drawn from the spraying CrowdStrike saw.

1. Rotate signing keys, preauthentication keys and service credentials after any suspected data exposure. Include keys kept in old backups and directory exports.
2. Enforce SAML signature validation, require IMDSv2 and limit which instances a cloud role can send commands to.
3. Hunt for ARTEX markers: command lines containing “artx” or “artex”, cloud roles starting with “artx”, “art18-” comments on administration commands, and the folder C:\ProgramData\artx5v\.
4. Patch internet-facing appliances, especially long-lived Linux servers, to the latest software and firmware.
5. Run an EDR sensor on every host, including servers thought to be unreachable from the internet.
6. Alert on password spraying against government, think tank and corporate accounts, which CrowdStrike saw at 12 or more organizations.

CrowdStrike published these BLOODALCHEMY indicators. They are defanged here; search DNS, proxy and endpoint logs for them.

Why This Campaign Matters Beyond VAPOR PANDA

CrowdStrike assesses that ARTEX is quickly gaining popularity among several China-nexus adversaries. It judges it highly likely they will keep adopting agentic frameworks over the next 12 months, paired with commercial LLMs. Microsoft reported on 29 October that the North Korean groups Onyx Sleet and Pearl Sleet use ARTEX too, as our North Korea AI hacking report explains.

None of the techniques are new. The change is that one small team can try many paths against many targets at once. Meyers told CyberScoop the attacks are “doing it at a speed and scale that we’re unaccustomed to.” Rotated keys, signed SAML and full sensor coverage matter more as a result, not less.

For the wider pattern, see our article on how attackers use agentic AI against organizations. Our threat actor landscape use case shows how to track groups like VAPOR PANDA against your own sectors.

What CrowdStrike Has Not Said

CrowdStrike did not name the second LLM or the organizations involved. The blog gives no breach total beyond the nine organizations with post-exploitation activity. CyberScoop reports that the campaign remains active, so the target count may still grow.