CrowdStrike 称 VAPOR PANDA 用 DeepSeek 驱动的 ARTEX 框架攻击 200 多家机构

CrowdStrike said the China-nexus adversary VAPOR PANDA used the AI-driven ARTEX intrusion framework, run primarily on the Chinese-developed DeepSeek large language model and a second commercial model, to target more than 200 organizations in at least 14 countries over an 11-day window beginning October 17, 2026. CrowdStrike Intelligence confirmed post-exploitation activity at nine organizations in a report published October 29, 2026.

CrowdStrike OverWatch observed the exploitation activity coming from a single ARTEX controller, which CrowdStrike Intelligence linked to VAPOR PANDA infrastructure. The controller periodically exposed adversary tooling, target files, and agent transcripts, pointing to multiple engagements, called tasks within the framework, running against multiple targets. At the nine organizations with confirmed post-exploitation activity, the adversary gained access, deployed the BLOODALCHEMY backdoor, and moved into credential spraying, network scanning, and reconnaissance. The adversary also ran password-spraying and credential-scanning activity against at least 12 more organizations, among them U.S.-based think tanks and government entities in Europe.

Targeting Across Regions and Sectors

CrowdStrike reported that VAPOR PANDA ran extensive intrusions inside the foreign ministries of two Latin America-based countries, likely breached a third, and staged target files for later use against foreign ministries in Central America and Asia. The adversary also compromised a Middle East-based interior ministry.

CrowdStrike said one engagement zeroed in on a single European country: its foreign ministry, presidency, and prime minister’s office, plus defense, justice, finance, and intelligence entities. Another engagement went after 19 U.S.-based organizations across the pharmaceutical, semiconductor, defense, nuclear, and financial sectors. Telecommunications providers in the U.S., Belgium, and the Philippines were also compromised.

Inside the ARTEX Operation

CrowdStrike said VAPOR PANDA ran ARTEX primarily with the DeepSeek model, supplemented by a second, subscription-based commercial LLM that CrowdStrike Intelligence could not confirm. In a single intrusion, the adversary’s planning agents consumed roughly 1.4 billion input tokens, a figure CrowdStrike said points to the scale of the automated activity and implies the operation as a whole consumed far more.

According to CrowdStrike, ARTEX pairs a main agent with subordinate planner and worker agents that share a graph of facts, findings, and goals, moving each engagement from initial access through host reconnaissance to lateral movement. The framework kept a human in the loop. Recovered transcripts showed an operator issuing instructions in Chinese, marked with a label translated as “human instruction” and timestamped in China Standard Time, telling agents to create web shells, extract domain administrator credentials, and check endpoint sensor coverage.

The report detailed the agent’s work at two U.S.-based pharmaceutical organizations. At the first, the agent combined an unsigned Security Assertion Markup Language (SAML) assertion with an XML external entity (XXE) flaw to reach the cloud Instance Metadata Service, gaining a role that could issue administration commands to thousands of instances, and from there recovered an enterprise administrator account. At the second, the agent planted web shells, exploited an unauthenticated orchestration service to gain root access inside a production container environment, read Local Administrator Password Solution passwords, and misused resource-based constrained delegation to impersonate a privileged account.

The report also describes an engagement against a Greek government entity, in which the operator gave the agent a 2022 directory export from the organization’s mail server that held authentication keys likely never rotated since. The agent used those keys to forge an administrator token and read mailboxes, then entered the internal network through VPN configurations taken from a user’s sent mail and a VPN client key the operator said came from a May 2024 email leak.

CrowdStrike said that across these engagements the agents pursued multiple attack paths in parallel, spanning web applications, cloud services, container environments, Active Directory, and mail and VPN infrastructure, and shifted to alternative approaches when a path failed. Where it had previously observed threat actors using AI agents to assist individual intrusions, VAPOR PANDA conducted several engagements at once, stepping in only to redirect the agents at decision points. The operator also had the agents evade endpoint defenses: at a global pharmaceutical organization, the operator told the agents to “find Windows machines in the domain without Falcon, judging by tasklist and folder listings,” using what CrowdStrike identified as People’s Republic of China red-team slang for the CrowdStrike Falcon sensor.

BLOODALCHEMY Deployment

CrowdStrike reported that at a Middle East-based interior ministry and a Latin America-based foreign ministry, VAPOR PANDA deployed BLOODALCHEMY, a backdoor first publicly documented in October 2023. The adversary renamed a legitimate GameHook binary as svchost.exe and used it to load a malicious DLL, graphics-hook-filter64.dll, which in turn decrypted the BLOODALCHEMY payload file graphics-hook_config.bin, and staged copies of all three files in exposed open directories. The implant contains an internal project path, D:\ProjectX\Merman_New\, which CrowdStrike said probably reflects the malware’s in-house development name. BLOODALCHEMY communicated with VAPOR PANDA infrastructure, including the command-and-control domains nginxmysql.com and sqlserver-sqlite.com, indicators the report said do not appear in prior public ARTEX reporting.

Assessment and Recommended Defenses

CrowdStrike stated that this campaign stands apart from the ARTEX activity industry sources reported under the Storm-0940 designation, which in its view likely indicates the framework is quickly gaining popularity among multiple China-nexus adversaries. Since 2021, VAPOR PANDA has mostly gone after government, think tank, energy, and extractive organizations in Europe, North America, Oceania, and the UK in order to build long-term access. The report described this campaign as the first time CrowdStrike had seen the adversary use AI-driven intrusion tooling, and a notable expansion of its targeting into pharmaceutical, semiconductor, nuclear, and defense organizations and foreign ministries in new regions. The operation’s reliance on DeepSeek and additional commercial models, run through a purpose-built harness, likely reflects a deliberate attempt to build a resilient toolchain across several model providers instead of relying on one service, according to the report.

CrowdStrike assessed that China-nexus adversaries will highly likely keep adopting agentic frameworks such as ARTEX over the next 12 months, pairing them with commercially available LLMs and enabling small teams to scale intrusions across many targets at once.

The report recommends that organizations rotate signing keys, preauthentication keys, and service credentials after any suspected data exposure, including keys sitting in historical backups and directory exports; enforce SAML signature validation, require IMDSv2, and limit cloud roles’ command-execution permissions to the minimum required instances; hunt for ARTEX markers such as artx or artex strings in command-line parameters, artx-prefixed cloud roles, and the C:\ProgramData\artx5v\ directory; patch internet-facing appliances, especially long-lived Linux-based servers; and deploy a real-time endpoint detection and response agent across the environment, including servers considered unreachable from the public internet.