A Chinese espionage group used an AI agent framework to run intrusions against more than 200 organizations worldwide in under two weeks, with a single human operator stepping in only at decision points. CrowdStrike's Counter Adversary Operations team attributes the campaign to VAPOR PANDA, a China-nexus adversary it has tracked since 2021, and calls it an escalation from AI-assisted single intrusions to many simultaneous ones.
Beginning on October 17, 2026, CrowdStrike OverWatch saw a single controller running the open-source ARTEX agent framework launch exploitation against entities in at least 14 countries over an 11-day window. Targets included foreign ministries in Latin America, Europe, Asia and the Middle East, semiconductor, defense and think tank organizations in the US, and telecommunications providers in several regions.
Nine confirmed break-ins, many more attempts
CrowdStrike Intelligence confirmed post-exploitation activity at nine organizations, where the attackers deployed the BLOODALCHEMY backdoor and followed up with credential spraying, network scanning and reconnaissance. Password-spraying and credential-scanning hit at least 12 more, including US think tanks and European government bodies.
The researchers say VAPOR PANDA conducted extensive intrusions at the foreign ministries of two Latin American countries, likely compromised a third, and compromised a Middle Eastern interior ministry. One engagement focused on a single European country's foreign ministry, presidency, prime minister's office and its defense, justice, finance and intelligence bodies. Another targeted 19 US organizations across the pharmaceutical, semiconductor, defense, nuclear and financial sectors. Telecom providers in the US, Belgium and the Philippines were also compromised.
An operator who only steps in at the forks
ARTEX coordinates a main agent with subordinate planner and worker agents that share a graph of facts, findings and goals. VAPOR PANDA ran it mainly on the Chinese DeepSeek large language model, supplemented by a second subscription-based commercial model CrowdStrike could not identify. In one intrusion alone the planning agents consumed on the order of 1.4 billion input tokens.
Agent transcripts exposed by the controller show an operator issuing instructions in Chinese, timestamped in China Standard Time, telling the agents to write web shells, extract domain administrator passwords and inventory endpoint sensor coverage. At one pharmaceutical company the agent chained an unsigned SAML assertion (a forged single sign-on token) with an XML external entity flaw to query the cloud metadata service, obtaining a role that could issue administration commands to thousands of instances. Against a Greek government entity, the operator fed the agent a 2022 mail server directory export containing keys that had likely never been rotated, which the agent used to forge an administrator token and read mailboxes.
The operator also told the agents to find Windows machines in the domain that were not running the CrowdStrike Falcon sensor, so follow-on work could focus on unprotected hosts.
Not the only Chinese crew using ARTEX
CrowdStrike stresses that this campaign is separate from the ARTEX activity Microsoft reported under the Storm-0940 designation, which we covered in AI agent tied to China's Storm-0940 hits software vendors. The firm assesses the framework is quickly gaining popularity among multiple China-nexus adversaries and that they will highly likely keep adopting such tools over the next 12 months. Earlier ARTEX use was tied to financially motivated actors, as in AI pentest agent linked to South Korean bank breaches.
Rotate old keys, enforce SAML signatures, hunt for artx
CrowdStrike recommends rotating signing keys, preauthentication keys and service credentials after any suspected data exposure, including keys in old backups and directory exports. Enforce SAML signature validation, require IMDSv2, and limit which instances cloud roles can command. Hunt for command lines containing artx or artex strings, artx-prefixed cloud roles, art18- administration-command comments and the C:\ProgramData\artx5v\ directory.
BLOODALCHEMY, first documented by Elastic in October 2023, was side-loaded by a legitimate GameHook binary renamed svchost.exe. Indicators published by CrowdStrike:
- C2 domains: nginxmysql[.]com (45[.]153[.]126[.]223), sqlserver-sqlite[.]com (89[.]46[.]234[.]50), www[.]ddduuuppp[.]com (192[.]121[.]47[.]20)
- Renamed GameHook binary (SHA-256): 49fe70419fd19b81ca8d730a6ef7c1ec71b681d60b390761070d42686c7d2068
- Loader graphics-hook-filter64.dll (SHA-256): 3fb5a9fb3e2cb1d6208966bd4e55d10282d19c7250d827efa560463d60a12ee4
- Payload graphics-hook_config.bin (SHA-256): 364251838edfcf5ef1107fa692da3c5bd9a540482449f645992830134bf807ab
The tradecraft is old: unrotated keys, forged tokens, web shells. What changed is the headcount it takes to use it against 200 targets at once.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.