VAPOR PANDA used ARTEX AI agents on 200+ organizations in 11 days, CrowdStrike says

CrowdStrike says a China-linked group it tracks as VAPOR PANDA pointed an open-source AI intrusion framework called ARTEX at more than 200 organizations in 14 or more countries over 11 days, starting on 17 October 2026. It confirmed hands-on intrusions at nine of them. The report, published on 29 October, is the clearest public account yet of an AI agent framework run at scale by a state-linked group, and it comes days after Microsoft described a separate group using the same tool.

Key points

• CrowdStrike says VAPOR PANDA used the ARTEX agent framework against more than 200 distinct organizations worldwide from 17 October 2026, directed by a single controller over an 11-day window.
• Post-exploitation activity was confirmed at nine organizations, where the group deployed the BLOODALCHEMY backdoor; password spraying or credential scanning hit at least 12 more.
• The agents ran on DeepSeek, a Chinese-developed model, plus a second commercial model CrowdStrike could not identify, with a human operator giving instructions in Chinese.
• CrowdStrike treats this as separate from the Storm-0940 ARTEX activity Microsoft reported on 21 October.
• Defenders can hunt for ARTEX markers such as command lines containing "artx" or "artex" and the directory C:\ProgramData\artx5v.

What to do

CrowdStrike's recommendations are practical and mostly about basics that AI speeds up the exploitation of:

• Rotate keys after any suspected exposure. That means signing keys, preauthentication keys and service credentials, including copies in old backups and directory exports. The group forged mail server tokens using keys that had never been rotated.
• Enforce SAML signature validation. The report lists unsigned SAML assertions among the techniques used.
• Require IMDSv2 on cloud instances and limit which instances cloud roles can run commands on. The group used XXE flaws to reach cloud metadata services.
• Patch internet-facing appliances, especially long-lived Linux servers.
• Put an EDR agent on every server, including ones not reachable from the internet. The operator told its agents to look for Windows hosts without the CrowdStrike Falcon sensor so follow-on work could focus on unprotected machines.
• Hunt for ARTEX markers: command-line strings containing "artx" or "artex", cloud roles with an "artx" prefix, "art18-" comments in administration commands, and the directory C:\ProgramData\artx5v.
• Block the published indicators. CrowdStrike lists three BLOODALCHEMY command-and-control domains (nginxmysql[.]com, sqlserver-sqlite[.]com and www[.]ddduuuppp[.]com) with their IP addresses, and file hashes for the loader components. The full table is in the report.

What happened

CrowdStrike's OverWatch threat hunters observed VAPOR PANDA running ARTEX to carry out intrusions in parallel against high-value targets. According to the report, from 17 October 2026 the group used ARTEX against more than 200 distinct organizations, with one controller steering activity against entities in at least 14 countries across an 11-day window.

The sectors are broad. CrowdStrike lists foreign ministries in Latin America, Europe, Asia and the Middle East, an interior ministry in the Middle East, pharmaceutical, semiconductor, defense, nuclear and financial organizations (largely US-based), think tanks and government bodies, and telecommunications providers in the US, Belgium and the Philippines.

Not all of that became a breach. CrowdStrike confirmed post-exploitation activity at nine organizations: the group gained access, deployed the BLOODALCHEMY backdoor, and carried out credential spraying, network scanning and reconnaissance. Password spraying or credential scanning reached at least 12 more. NBC News, which reported the story on 29 October, says the hackers "targeted" the organizations, a wording that matches the report's distinction between targeting and compromise.

Targeted (more than)200

Spray or scan hit (at least)12

Post-exploitation confirmed9

VAPOR PANDA ARTEX campaign, organizations by stage (CrowdStrike, 17 to 28 October 2026) (organizations)

	organizations
Targeted (more than)	200
Spray or scan hit (at least)	12
Post-exploitation confirmed	9

Source: CrowdStrike, VAPOR PANDA report, 29 October 2026

How it works

ARTEX is a multi-agent framework: a main agent coordinates planner and worker agents that share a graph of facts, findings and goals. Microsoft describes it as written in Go with a Next.js front end, able to use any AI model, and covering the workflow from reconnaissance to data exfiltration with little human input. It supports English, Korean, Mandarin, Spanish and Japanese.

In this campaign, CrowdStrike says the agents used DeepSeek plus a second, subscription-based commercial model it could not identify. A human operator wrote instructions in Chinese and steered the agents at decision points. The scale of the machine work is visible in one detail: a single planning agent in one intrusion consumed roughly 1.4 billion input tokens.

The techniques are not new, which is part of the point. The report lists unsigned SAML assertions, XXE flaws used to reach cloud metadata services, web shells, reads of LAPS passwords, resource-based constrained delegation abuse, forged mail server tokens using unrotated keys, and VPN access using leaked configurations. Tunneling used Tor, SOCKS proxies, Chisel and SoftEther.

The payload, BLOODALCHEMY, was first publicly documented in October 2023. CrowdStrike says a renamed legitimate GameHook binary (named svchost.exe) loads a malicious DLL, which decrypts the final payload from a configuration file.

Background

ARTEX started as an open-source AI penetration-testing tool developed in China. CrowdStrike reported earlier in October that an attacker had used it against South Korean financial organizations, and the tool's developer then said the project would move to closed source, according to AFP as relayed in search coverage of that earlier report; we did not open that earlier report ourselves.

On 21 October, Microsoft said a China state-aligned actor it tracks as Storm-0940 used ARTEX in a supply chain compromise of ConnectWise's Cloud Backup application, then tried to sign in to more than 2,250 Microsoft 365 tenants at up to 2,900 attempts per minute. In some cases less than three hours passed between initial targeting and privileged access. Microsoft says the activity did not result from a compromise of its own systems. CrowdStrike says the VAPOR PANDA campaign is separate from Storm-0940's.

VAPOR PANDA itself is not new: CrowdStrike says it has targeted government, think tank, energy and extractive organizations since 2021 to keep long-term access. This is the first time CrowdStrike has seen it use AI-driven intrusion tooling, and the tooling widened its targeting into new sectors and regions.

What it means

For defenders, the headline is speed and breadth rather than novel exploits. An operator who once had to pick a handful of targets can now point agents at hundreds, and the agents handle the repetitive reconnaissance and spraying. CrowdStrike expects China-nexus adversaries to keep adopting agentic frameworks like ARTEX over the next 12 months, pairing them with commercial models.

For AI labs and model hosts, the report is another case of commercial and open models being used in offensive work. Which model sits behind a given agent matters less than the controls around it, and CrowdStrike could not name the second model, so no conclusion about a particular vendor is possible.

For smaller organizations, the practical lesson is the dull one in the list above: rotate old keys, verify SAML signatures, require IMDSv2 and cover every server with endpoint monitoring. The operator's instruction to find hosts without Falcon shows that coverage gaps are exactly what the agents were told to look for.

What we don't know yet

• Which organizations were compromised. CrowdStrike names sectors and regions, not victims, and says nine had confirmed post-exploitation.
• The identity of the second commercial model. CrowdStrike could not identify it.
• How the 200-plus targets were chosen, and whether more intrusions were found after the 11-day window.
• Whether CrowdStrike's separation of VAPOR PANDA from Storm-0940 will hold as more reports arrive. Both used ARTEX, but the two vendors describe different activity, dates and targets.

What to watch next

Expect further vendor reports on ARTEX activity, since Microsoft says other threat actors in several regions have used it. Watch for updated indicators from CrowdStrike, any government advisory on the nine confirmed intrusions, and responses from the model providers whose services the agents called. For background on how agent attacks are being detected, see Cisco's Project Quarry open-source rules.

Sources

• CrowdStrike: VAPOR PANDA uses ARTEX to scale a global campaign (primary source, 29 October 2026)
• NBC News: China-linked hackers used AI to target 200 organizations, CrowdStrike says
• Microsoft Security Blog: Storm-0940 uses ARTEX in the ConnectWise supply chain compromise
• The Hacker News: China-linked hackers use ARTEX AI