CrowdStrike says VAPOR PANDA used the ARTEX agent framework and DeepSeek to target more than 200 organizations

CrowdStrike has published a detailed account of a China-nexus intrusion campaign in which a single threat actor used an agentic AI framework to run attacks against more than 200 organizations in at least 14 countries at the same time. In a report released on October 29, 2026 by its Counter Adversary Operations team, the company attributes the activity to VAPOR PANDA, a targeted-intrusion group it has tracked since 2021, and identifies the tooling as ARTEX, a multi-agent framework that the actor ran primarily on DeepSeek, supplemented by a second, subscription-based commercial language model that CrowdStrike says it could not identify.

The campaign began on October 17, 2026 and, according to CrowdStrike, unfolded over an 11-day window. Within that period the company confirmed post-exploitation activity at nine organizations, where the actor gained access, deployed the BLOODALCHEMY backdoor and carried out credential spraying, network scanning and reconnaissance. At least twelve further organizations saw password spraying or credential scanning without confirmed follow-on access. The targets named in the report include foreign ministries, offices of presidents and prime ministers, defense, justice, finance and intelligence bodies, pharmaceutical and semiconductor companies, nuclear-sector organizations, think tanks and telecommunications providers.

CrowdStrike describes the operation as "an escalation in China-nexus use of AI agents," and the distinction it draws is about scale rather than novelty of individual techniques. Earlier publicly documented cases of AI-assisted intrusion typically involved one engagement at a time. In this campaign, a human operator supervised many engagements running in parallel and, in the report's words, intervened "only to steer the agents at decision points." The company assesses that VAPOR PANDA adopted the framework to extend its existing mission of building long-term access to high-value networks, not to change what it is after.

··········

HOW THE ARTEX FRAMEWORK ORGANIZES AN INTRUSION.

ARTEX, as CrowdStrike describes it, is built around a main agent that coordinates subordinate planner and worker agents. All of them share a common graph of facts, findings and goals, and the framework moves each engagement through the familiar stages of an intrusion, from initial access to host reconnaissance and then lateral movement. Internally, ARTEX refers to each engagement as a "task," which is consistent with a design in which one controller can hold many targets open simultaneously and advance them independently.

The report does not explain in detail how responsibilities are split between planner and worker agents, so the exact division of labor remains undisclosed. What CrowdStrike does document is the behavior visible in the agent transcripts it recovered: the agents pursued several attack paths at once across web applications, cloud services, container platforms, Active Directory and mail or VPN systems, and they switched approaches when one path failed. That pattern, which a human team would normally spread across several operators and days of work, is the practical reason the framework lets what CrowdStrike calls "a small team" pursue a wider target set than manual operations would support.

Separate industry reporting already tracks ARTEX activity under the Storm-0940 designation. CrowdStrike states that the VAPOR PANDA campaign it describes is distinct from that activity, which suggests the framework, or a close relative of it, is being used by more than one operator. The report does not say who built ARTEX or how it is distributed.

··········

THE ROLE OF DEEPSEEK AND A SECOND COMMERCIAL MODEL.

The most closely watched detail for users of mainstream AI services is the choice of models. According to CrowdStrike, VAPOR PANDA ran ARTEX mainly on DeepSeek, the Chinese-developed model family, and supplemented it with a subscription-based commercial model whose provider the company could not determine. CrowdStrike reads this multi-provider setup as deliberate, describing it as an effort to build "a resilient toolchain from multiple model providers," so that the loss of access to one service would not halt the operation.

The report also gives one of the few public figures on how many tokens an agentic intrusion consumes. In a single intrusion, the planning agents alone used roughly 1.4 billion input tokens. CrowdStrike notes that this implies much higher total consumption across the full operation, though it does not publish an aggregate figure, and the number refers only to input tokens of the planning layer, not to worker agents or output.

........

Item	Figure reported by CrowdStrike
Campaign start	October 17, 2026
Duration observed	11 days
Organizations targeted	More than 200
Countries	At least 14
Confirmed post-exploitation	9 organizations
Spraying or scanning only	At least 12 more organizations
Planner input tokens, one intrusion	About 1.4 billion
Primary model	DeepSeek
Secondary model	Unidentified subscription-based commercial LLM

........

Two points the report leaves open are worth stating plainly. CrowdStrike does not say whether DeepSeek or the second provider was notified, and it does not discuss whether either service applied safeguards that the actor had to work around. It also does not specify whether DeepSeek was accessed through the company's hosted API, a third-party host or self-deployed open weights, a distinction that matters a great deal for what a provider could have detected or blocked. Readers should therefore treat the report as evidence of how the models were used, not as a finding about any provider's policies or controls.

··········

TARGETS, SECTORS AND NOTABLE ENGAGEMENTS.

VAPOR PANDA has historically focused on government bodies, think tanks, energy and extractive organizations in Europe, North America, Oceania and the United Kingdom. CrowdStrike says this campaign is the first time it has observed the group using AI-driven intrusion tooling, and that the shift coincided with a broader target list covering new sectors and regions.

Among the engagements the report highlights are extensive intrusions at the foreign ministries of two Latin American countries, with a third likely compromised, and a compromise of a Middle East interior ministry. One engagement alone covered 19 organizations based in the United States. Telecommunications providers in the United States, Belgium and the Philippines were also compromised, according to the company.

CrowdStrike walks through several intrusions at a high level to show how the agents combined weaknesses. At two pharmaceutical organizations, the agents chained configuration and authentication flaws in web and cloud services to obtain privileged cloud roles, root access inside a production container environment and, eventually, privileged directory accounts. At a Greek government entity, they used an old directory export containing keys that had likely never been rotated to forge an administrative token and read mailboxes, and then used VPN material found in email, including a VPN client key from a May 2024 email leak, to reach the internal network. The common thread is that none of these paths depended on a new exploit class; the agents were effective at finding and linking long-standing weaknesses quickly and across many targets at once.

The report also records an explicit evasion instruction. The human operator told the agents to identify Windows machines in the domain that were not running CrowdStrike's Falcon sensor, judging from process lists and folder listings, so that follow-on activity would concentrate on unprotected hosts.

··········

HOW CROWDSTRIKE DETECTED THE CAMPAIGN.

The visibility CrowdStrike reports came largely from the attacker's own infrastructure. CrowdStrike OverWatch observed exploitation activity originating from a single ARTEX controller, which CrowdStrike Intelligence linked to VAPOR PANDA infrastructure. That controller intermittently exposed adversary tooling, target files and ARTEX agent transcripts. Those transcripts are the source of several of the report's most specific claims: operator instructions were written in Chinese, labeled as human instructions and timestamped in China Standard Time, and they show the agents' parallel attempts and changes of approach.

Falcon telemetry, meanwhile, revealed the deployment of BLOODALCHEMY and its command-and-control infrastructure. BLOODALCHEMY is not new; it was first publicly documented in October 2023. In this campaign CrowdStrike observed it at the Middle East interior ministry and one of the Latin American foreign ministries, loaded through a renamed legitimate binary that sideloads a malicious DLL, which then decrypts the payload. The report lists three command-and-control domains, nginxmysql[.]com, sqlserver-sqlite[.]com and www[.]ddduuuppp[.]com, along with full hashes and IP indicators in its IOC table.

··········

WHAT SECURITY TEAMS AND AI USERS SHOULD DO NOW.

For defenders, the practical guidance in the report is notable for how conventional it is. CrowdStrike recommends rotating signing keys, preauthentication keys and service credentials after any suspected exposure, explicitly including keys sitting in old backups and directory exports. It advises enforcing SAML signature validation, requiring IMDSv2 for cloud instance metadata and limiting the permissions of cloud roles that can issue commands to instances. It also calls for patching internet-facing appliances, with particular attention to long-lived Linux servers, and for deploying real-time EDR across the whole environment, including servers that are not reachable from the internet.

........

Area	CrowdStrike recommendation
Credentials	Rotate signing, preauthentication and service keys after suspected exposure, including old backups
Identity	Enforce SAML signature validation
Cloud	Require IMDSv2 and minimize command permissions on cloud roles
Patching	Patch internet-facing appliances, especially long-lived Linux servers
Endpoint	Deploy real-time EDR everywhere, including internal-only servers
Hunting	Look for ARTEX markers in command lines, cloud role names and file paths

........

The hunting guidance is the only part specific to ARTEX. CrowdStrike suggests looking for command lines containing "artx" or "artex," cloud roles with an artx prefix, administration commands carrying "art18-" comments and the directory C:\ProgramData\artx5v\. These markers come from this campaign and could change quickly if the operators adapt, so they are useful for retrospective hunting rather than as durable detections.

The lesson for organizations is that agentic tooling raises the cost of leaving old weaknesses in place. An attacker who can run dozens of engagements in parallel benefits most from unrotated keys, unvalidated assertions and unmonitored servers, because the agents can test those weaknesses across every target at once. Unmanaged hosts are a specific risk, since the operator explicitly directed the agents toward machines without an endpoint sensor. For teams building or operating AI agents internally, the report also shows why agent transcripts and controller logs are valuable forensic material: in this case they were what allowed investigators to reconstruct the operator's instructions.

For everyday users of DeepSeek and other commercial models, the report does not describe any compromise of those services or of their users' data. It describes the models being used as reasoning engines inside an attacker's framework. Data Studios has covered related cases in which AI agents appeared in real intrusions, including Unit 42's report on agentic AI post-exploitation in a PHP2Shell intrusion, and supply-chain risks around AI tooling such as the malicious LiteLLM 1.107.0 release.

··········

WHAT IS ESTABLISHED AND WHAT REMAINS UNCERTAIN.

The established facts, as documented by CrowdStrike, are the scale and timing of the campaign: more than 200 targeted organizations in at least 14 countries over an 11-day window starting October 17, nine confirmed post-exploitation cases, the use of the ARTEX multi-agent framework with a human operator steering at decision points, DeepSeek as the primary model alongside an unidentified commercial model, roughly 1.4 billion planner input tokens in one intrusion, and the deployment of the BLOODALCHEMY backdoor at at least two government bodies. The attribution to VAPOR PANDA and the link to China rest on CrowdStrike's analysis of infrastructure, tooling and the Chinese-language, China Standard Time-stamped operator instructions in the recovered transcripts.

Several questions remain open. CrowdStrike does not identify the second model provider, does not say how DeepSeek was accessed, and does not state whether either provider was informed or took action. It does not explain who developed ARTEX or how it relates to the activity tracked separately as Storm-0940, beyond saying the campaigns are distinct. It also gives no quantitative comparison between the agents' speed and that of human operators. The company's forward-looking assessment is that "China-nexus adversaries will highly likely continue adopting agentic frameworks such as ARTEX over the next 12 months," a forecast that is CrowdStrike's judgment rather than an observed fact. What the report does establish clearly is that a single actor used commercial and Chinese-developed language models to run a parallel, multi-country intrusion campaign, and that the defensive gap it exploited was mostly old, unrotated and unmonitored infrastructure.

··········

FOLLOW US FOR MORE.

·····

DATA STUDIOS

·····

datastudios.org