CrowdStrike links Vapor Panda to AI-driven ARTEX intrusions across 14 countries

CrowdStrike’s OverWatch team observed Vapor Panda activity from a single ARTEX controller against entities in at least 14 countries during an 11-day period starting Oct. 17, 2026, and the company attributed the campaign to the China-based intrusion adversary also tracked as VexatiousTemper.

CrowdStrike published its VAPOR PANDA report on Oct. 29, 2026, describing the activity as Vapor Panda’s first observed use of AI-driven intrusion tools, with targeting expanded to pharmaceutical, semiconductor, nuclear, and defense sectors and foreign ministries. CrowdStrike said planning agents used roughly 1.4 billion input tokens during one intrusion. The pace meant about 18 new targets per day from one controller, and the low confirmed rate mattered little because extra attempts cost almost nothing. Nine organizations showed confirmed post-exploitation activity involving BLOODALCHEMY deployment plus credential spraying, network scanning, and reconnaissance, CrowdStrike said.

The adversary ran password-spraying and credential-scanning against at least 12 additional organizations, including U.S. think tanks and European government entities. Targets included the foreign ministries of two Latin America-based countries, a likely third, and staged files for ministries in Central America and Asia. A separate engagement targeted 19 U.S. organizations across pharmaceutical, semiconductor, defense, nuclear, and financial sectors. The adversary compromised telecom providers in the U.S., Belgium, and the Philippines.

The campaign compromised an interior ministry based in the Middle East. One European engagement hit a foreign ministry, presidency, prime minister’s office, and defense, justice, finance, and intelligence bodies. Among the breached entities, two were pharmaceutical companies based in the U.S.

ARTEX is a Go-based AI-powered penetration testing framework used against high-value targets. The framework manages one primary agent together with planner and worker agents through a shared graph containing facts, findings, and goals. A Chinese security engineer published ARTEX on GitHub in 2026, and developer Li Puhua, also known as Autumn-27, later made it closed source.

CrowdStrike said ARTEX ran mainly on DeepSeek plus an unconfirmed second commercial LLM. The company said using DeepSeek and additional commercial LLMs likely reflects a deliberate effort to build a resilient multi-provider toolchain, with reliance on several language models through one harness intended to avoid dependence on any single service. Zscaler ThreatLabz said, “It orchestrates multiple LLM backends to autonomously perform reconnaissance, vulnerability identification, and exploitation, significantly lowering the technical barrier for conducting complex intrusion campaigns.”

Transcripts showed an operator typing instructions in Chinese timestamped in China Standard Time to write web shells, extract domain administrator passwords, and inventory endpoint sensors. The operator told agents, “find Windows machines in the domain without Falcon, judging by tasklist and folder listings,” using PRC slang for the CrowdStrike sensor.

BLOODALCHEMY is a ShadowPad derivative first publicly documented in October 2023. Vapor Panda deployed BLOODALCHEMY using a renamed GameHook binary to load a malicious DLL that decrypted a payload file placed in open directories. The implant contains the internal project path D:\ProjectX\Merman_New\. BLOODALCHEMY contacted Vapor Panda infrastructure at domains nginxmysql.com and sqlserver-sqlite.com not seen in earlier public ARTEX reporting.

At one U.S. drugmaker, the agent chained an unsigned SAML assertion and XXE flaw to reach cloud metadata and recover an enterprise admin account. At another U.S. drugmaker, the agent planted shells, gained container root access, read LAPS passwords, and abused constrained delegation to impersonate a privileged account. Against a Greek government body, the operator gave the agent a 2022 mail export with unrotated keys to forge an admin token, read mail, and enter the internal network using VPN data and a May 2024 leak key. Agents ran multiple paths at once across web apps, cloud, containers, Active Directory, mail, and VPN, switching when one failed.

CrowdStrike said this campaign differs from Storm-0940 ARTEX activity, suggesting the framework is spreading quickly among multiple China-nexus adversaries. Microsoft said Storm-0940 used ARTEX to automate ConnectWise intrusions in mid-October 2026, striking over 300 accounts at eight firms at more than 2,900 tries per minute. Microsoft logged over 151,000 failed sign-ins and saw successful logins using ConnectWise cloud application identities.

Storm-0940 has been active since at least 2021 and was seen abusing ARTEX to automate attacks starting in early September 2026. Microsoft said, “Following the unauthorized access, Storm-0940 used Artex to attempt to sign-in to more than 2,250 tenants.”

Huntress observed intruders logging in with compromised ConnectWise application credentials to reach hundreds of Microsoft 365 tenants, including more than 300 Entra tenants. Microsoft logged over 151,000 failed sign-ins and saw successful logins using ConnectWise cloud application identities. ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management services in response to the Storm-0940 intrusion.

On Oct. 7, 2026, CrowdStrike reported an unknown actor used ARTEX with DeepSeek and Claude Code to hit at least seven South Korean banks, exposing about 25,000 customers of one bank. CrowdStrike assessed with moderate confidence that the South Korean actor was a 26-year-old Chinese speaker working for money, not a state. Open directories on a Hong Kong-based server exposed session histories of the actor who used ARTEX against South Korean financial institutions.

CrowdStrike assessed China-nexus groups will highly likely keep adopting agentic frameworks such as ARTEX for the next twelve months. CrowdStrike published an assessment about a week earlier finding four groups used AI models including Claude and DeepSeek to automate attacks from May to August.

CrowdStrike first identified Vapor Panda in February 2021, and the group overlaps with Trend Micro’s Earth Estries cluster. Vapor Panda has mainly focused on government, think tank, energy, and extractive targets in Oceania, the UK, Europe, and North America since 2021. Vapor Panda abused Microsoft Exchange ProxyLogon flaws in early 2021.

CrowdStrike disclosed Hollow Panda, Overcast Panda, Titan Panda, and Veiled Panda as additional China-linked groups stealing intelligence and IP. Overcast Panda installed FlowCloud through DLL sideloading after physical access in China, using cloud C2 for logging, screenshots, files, and credential theft. Titan Panda exploited an Intapp Time Server IIS machine key flaw found in April 2026 to release IceGiant against North American law firms.

Anthropic, Google, and OpenAI disclosed past-year cases of cutting off state-linked accounts and said monitored commercial models give defenders more sight than open models. DeepSeek can be downloaded and run locally without oversight, has not replied to CrowdStrike, and Beijing regularly denies cyber spying.

A separate actor published personal records of more than 40,000 Department of Homeland Security employees, including nearly 1,000 at CISA, before the midterm elections.

CrowdStrike urged rotating signing, preauthentication, and service keys after suspected exposure, including keys in old backups and directory exports. The company urged SAML signature checks, IMDSv2 requirement, and least-privilege cloud role permissions. CrowdStrike urged hunting for ARTEX markers such as artx strings, artx cloud roles, and C:\ProgramData\artx5v\. It also urged patching internet-facing appliances, especially older Linux servers, and installing EDR on all servers including offline ones.

The Hacker News described the actors as Chinese state-sponsored, while the Chinese government has routinely denied involvement in cyberespionage.