CrowdStrike said a China-nexus espionage group it tracks as Vapor Panda used ARTEX, an agentic AI framework running primarily on DeepSeek's model, to target more than 200 organizations worldwide in a campaign that began October 17, 2026. The company's Counter Adversary Operations team said it confirmed post-exploitation activity at nine of those organizations.
A single ARTEX controller directed activity against entities in at least 14 countries over an 11-day window. Beyond the nine confirmed intrusions, at least 12 more organizations were hit with password spraying or credential scanning, including US think tanks and European government entities. CrowdStrike said this is the first time it has observed Vapor Panda using AI-driven intrusion tooling.
ARTEX coordinates a main agent with planner and worker agents that share a graph of facts, findings and goals, pushing each engagement from initial access through reconnaissance and lateral movement. DeepSeek served as the primary model, supplemented by a second subscription-based commercial LLM that CrowdStrike could not identify. Recovered transcripts showed the planning agents consumed roughly 1.4 billion input tokens in a single intrusion.
Key facts
- 01CrowdStrike says Vapor Panda targeted 200+ organizations in at least 14 countries over 11 days starting October 17, 2026.
- 02Post-exploitation activity was confirmed at nine organizations; at least 12 more faced password spraying or credential scanning.
- 03DeepSeek was the primary model inside the ARTEX agent framework, backed by a second commercial LLM CrowdStrike could not identify.
- 04Planning agents consumed roughly 1.4 billion input tokens in a single intrusion, per recovered transcripts.
- 05It is Vapor Panda's first observed use of AI-driven intrusion tooling, according to CrowdStrike.
The agents did not run unsupervised. A human operator issued instructions in Chinese, labeled "human instruction" in the transcripts, and stepped in at key decision points. At one global pharmaceutical organization, the operator told the agents to find Windows machines in the domain that lacked CrowdStrike's Falcon sensor, so activity could focus on unprotected hosts.
The target list spans governments and industry. CrowdStrike named foreign ministries in Latin America, Europe, Asia and the Middle East, a Middle Eastern interior ministry, and a European country's presidency, prime minister's office, and defense, justice, finance and intelligence entities. In the US, targets included pharmaceutical, semiconductor, defense, nuclear, financial and think tank organizations, and telecommunications providers in the US, Belgium and the Philippines were also hit.
The techniques were broad. In one US pharmaceutical incident, an agent exploited an unsigned SAML assertion and an XML external entity flaw to obtain cloud metadata credentials with administrative command capability over thousands of instances. In another, the attackers used web shells and an unauthenticated orchestration service to gain root access in a production container environment, then abused LAPS passwords and resource-based constrained delegation.
Elsewhere, the group forged a mail server admin token using unrotated keys, used stolen or leaked VPN configurations and client keys, and routed traffic through Tor, SOCKS proxies, Chisel and SoftEther. At a Middle Eastern interior ministry and a Latin American foreign ministry, it deployed the BLOODALCHEMY backdoor through a renamed GameHook binary, a malicious DLL and an encrypted payload file. CrowdStrike said it found command-and-control infrastructure tied to the malware that was absent from earlier public reporting on ARTEX.
Since 2021, Vapor Panda has mainly targeted government, think tank, energy and extractive organizations in Europe, North America, Oceania and the UK. CrowdStrike said it had previously seen ARTEX and similar frameworks used by financially motivated and unattributed actors, and that separate ARTEX activity reported under the Storm-0940 designation, which it treats as distinct from this campaign, suggests multiple China-linked actors are adopting the framework.
CrowdStrike's recommended defenses include rotating signing, preauthentication and service credentials after suspected exposure, enforcing SAML signature validation, requiring IMDSv2, restricting cloud role command execution, patching internet-facing systems, and deploying endpoint detection across all environments, including servers that do not face the internet.
CrowdStrike assessed that China-linked adversaries are highly likely to keep adopting agentic frameworks like ARTEX, combined with commercial LLMs, over the next 12 months.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
