VAPOR PANDA Deploys ARTEX AI Agents to Attack Over 200 Targets
TL;DR
CrowdStrike identified a major cyber espionage push called the VAPOR PANDA ARTEX campaign targeting over 200 global entities. The adversary ran the ARTEX framework alongside DeepSeek language models to conduct multiple parallel network intrusions. Consequently, human operators intervened only at critical decision points while deploying the custom BLOODALCHEMY backdoor.
What Happened in the Campaign
Beginning on October 17, 2026, security analysts tracked attacks launched from a single central controller. According to a report on the VAPOR PANDA ARTEX campaign by CrowdStrike OverWatch, the adversary targeted entities across at least 14 nations. These victims included foreign ministries in Latin America, Europe, Asia, and the Middle East. In addition, the hackers hit 19 U.S. organizations across semiconductor, defense, nuclear, and pharmaceutical sectors.
The attackers coordinated automated agents through the ARTEX system. This system connects planner and worker agents over a shared knowledge graph. Furthermore, the framework kept a human operator in control. Transcripts showed an operator issuing guidance in Chinese labeled “human instruction” under China Standard Time. “In a single intrusion, VAPOR PANDA’s planning agents consumed on the order of 1.4 billion input tokens,” CrowdStrike reported.
Parallel Intrusions and Defense Evasion
The automated agents pursued multiple intrusion paths across web applications, cloud services, and internal directories. For example, at a U.S. pharmaceutical company, an agent chained an unsigned SAML assertion with an XXE flaw. This allowed the agent to query the cloud metadata service and seize administrative privileges. At a second drugmaker, the agent deployed web shells and retrieved local administrator passwords.
Moreover, the attackers built endpoint detection evasion directly into their automated tasks. At a global healthcare firm, the human operator instructed the agent to find Windows systems without active Falcon sensors. Specifically, the attacker used Chinese red-team slang for the sensor to isolate unmonitored machines. Meanwhile, the group deployed the BLOODALCHEMY backdoor at a Latin American foreign ministry and a Middle Eastern interior ministry.
Who Is Behind the Activity
CrowdStrike attributes this activity to VAPOR PANDA with high confidence. The group is a well-known China-nexus adversary that has targeted foreign governments, think tanks, and energy firms since 2021. However, this operation represents the group’s first documented use of autonomous software agents.
Investigators note that this activity remains separate from Storm-0940, another group experimenting with similar tooling. Instead, the findings show that Chinese state-aligned actors are rapidly adopting commercial artificial intelligence models. “VAPOR PANDA ran ARTEX primarily with the Chinese-origin DeepSeek LLM, supplemented with a second, subscription-based commercial LLM,” CrowdStrike explained. By combining open tools with model APIs, small teams can strike dozens of targets at once.
Impact and Global Scale
The operational scale of the VAPOR PANDA ARTEX intrusion set highlights a shift in cyber warfare. Across an 11-day window, the adversary probed more than 200 distinct organizations worldwide. In fact, CrowdStrike confirmed post-exploitation actions across nine organizations, including telecommunications firms in the United States, Belgium, and the Philippines.
Additionally, the attackers ran password spraying against 12 other entities, including European government offices and American think tanks. Against a Greek government agency, the operator supplied the agent with an old 2022 email directory export. The agent used these unrotated keys to forge tokens, read mailboxes, and harvest internal VPN credentials.
How Organizations Can Stay Protected
Defenders must adapt to threats that use automated agents to scale their operations. First, security teams should ensure complete endpoint sensor coverage across every active Windows workstation and server. Because the adversary actively hunts for unmonitored machines, any blind spot provides an immediate entry point. Furthermore, administrators must rotate cryptographic keys, service account passwords, and VPN certificates regularly. Organizations should also disable unsigned SAML assertions and monitor internal networks for unauthorized command-and-control traffic tied to BLOODALCHEMY.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
