New research from CrowdStrike has identified a global cyberespionage campaign by China-nexus threat actor VAPOR PANDA that uses the ARTEX agentic AI (artificial intelligence framework, the Chinese-developed DeepSeek large language model (LLM), and a second commercial LLM to conduct simultaneous intrusions against high-value targets. Beginning Oct. 17, 2026, the campaign targeted more than 200 organizations worldwide, including foreign ministries across Latin America, Europe, Asia and the Middle East, U.S. semiconductor, defense and think tank organizations, and telecommunications providers in multiple regions.
CrowdStrike OverWatch observed exploitation activity directed by a single ARTEX controller against entities in at least 14 countries over 11 days, marking an escalation in the use of AI agents by China-aligned adversaries to coordinate multiple intrusion operations.
VAPOR PANDA used ARTEX to coordinate planner and worker agents across intrusion activities, including reconnaissance, credential theft, lateral movement and the deployment of web shells. The operation retained human oversight, with an operator directing the agents at key decision points, while the AI-driven workflow enabled multiple engagements to proceed in parallel.
CrowdStrike Intelligence confirmed post-exploitation activity at nine organizations, where the attackers deployed the BLOODALCHEMY backdoor and conducted credential spraying, network scanning and reconnaissance. The researchers said the campaign also incorporated endpoint defense evasion by instructing agents to identify Windows systems without the CrowdStrike Falcon sensor, highlighting how agentic frameworks can help relatively small teams expand their targeting and intrusion capabilities.
“In a single intrusion, VAPOR PANDA’s planning agents consumed on the order of 1.4 billion input tokens, indicating the scale of the automated activity and implying far higher consumption across the operation as a whole,” CrowdStrike researchers said in a recent blog post. “The campaign’s reliance on open source components layered on top of commercial LLM subscriptions illustrates how adversaries can assemble scalable, multi-agent intrusions largely from publicly available resources.”
ARTEX coordinates a main agent and subordinate planner and worker agents through a shared graph of facts, findings and goals, moving each engagement from initial access to host reconnaissance and lateral movement. The framework retained human oversight, with recovered transcripts showing an operator issuing instructions in Chinese, marked human instruction and timestamped in China Standard Time. The operator directed agents to create web shells, extract domain administrator passwords and inventory endpoint sensor coverage.
While CrowdStrike has previously observed threat actors using AI agents to assist individual intrusions, VAPOR PANDA used ARTEX to coordinate multiple engagements simultaneously, with the operator intervening only at key decision points to steer the agents.
The recovered transcripts and staged tooling show an adversary pairing an AI-driven workflow with well-established tradecraft. At a U.S.-based pharmaceutical organization, the agent chained an unsigned Security Assertion Markup Language (SAML) assertion and an XML external entity (XXE) flaw to query the cloud Instance Metadata Service. This gave it a role capable of issuing administration commands to thousands of instances, and it then escalated to recover an enterprise administrator account.
At a second U.S.-based pharmaceutical organization, the agent deployed web shells and abused an unauthenticated orchestration service to obtain root access in a production container environment. It also read Local Administrator Password Solution (LAPS) passwords and abused resource-based constrained delegation to impersonate a privileged account.
Against a Greek government entity, the operator supplied the agent with a 2022 directory export from the organization’s mail server, which contained authentication keys that had likely not been rotated since the export. The agent used those keys to forge an administrator token and read mailboxes. It then reached the internal network using VPN configurations recovered from a user’s sent mail, together with a VPN client key that the operator described as originating from a May 2024 email leak.
The AI agents pursued many attack paths at once, across web applications, cloud services, container environments, Active Directory, and mail and VPN infrastructure, and switched approaches when one failed. This breadth likely lets a single operator use a wider range of techniques against more targets than manual operations would allow.
VAPOR PANDA also directed the agents to evade endpoint defenses. At a global pharmaceutical organization, the operator told them to find Windows machines in the domain that lacked CrowdStrike’s Falcon sensor, using the Chinese red-team slang for it. Building sensor coverage checks into the workflow lets the adversary focus follow-on activity on unprotected hosts.
At a Middle East-based interior ministry and a Latin America-based foreign ministry, VAPOR PANDA deployed BLOODALCHEMY, a backdoor first publicly documented in October 2023. The group disguised a legitimate program to load a malicious component that unpacked the backdoor, and it staged copies of the files in exposed, open directories. An internal project path in the implant likely reflects the malware’s in-house development name. Across the observed activity, BLOODALCHEMY communicated with VAPOR PANDA infrastructure.
CrowdStrike assesses that this campaign is separate from the ARTEX activity reported by industry under the Storm-0940 designation, likely indicating the AI-based framework is quickly gaining popularity among multiple China-nexus adversaries. “Since 2021, VAPOR PANDA has primarily targeted government, think tank, energy, and extractive organizations across Europe, North America, Oceania, and the UK to develop long-term access. This campaign marks the adversary’s first observed use of AI-driven intrusion tooling and a notable broadening of its targeting into the pharmaceutical, semiconductor, nuclear, and defense sectors, as well as foreign ministries, across new regions.”
Moreover, agentic tooling like ARTEX enables this scale of expansion at speed, allowing a small team to pursue a wider target set than manual operations would support, rather than wholesale shift away from the adversary’s established access-development mission. The operation’s reliance on DeepSeek and additional commercial LLMs, run through a purpose-built harness, likely reflects a deliberate effort to construct a resilient toolchain from multiple model providers rather than depend on any single service.
China-nexus adversaries will highly likely continue adopting agentic frameworks such as ARTEX over the next 12 months, pairing them with commercially available LLMs, and enabling small teams to quickly scale intrusions across many targets simultaneously.
CrowdStrike recommended that organizations rotate signing keys, preauthentication keys, and service credentials after any suspected data exposure, including keys contained in historical backups and directory exports. It also advised enforcing SAML signature validation, requiring IMDSv2, and restricting cloud roles’ command-execution permissions to the minimum required instances.
The company urged defenders to hunt for ARTEX markers, including command-line parameters. Organizations should also patch internet-facing appliances, particularly long-lived Linux-based servers, and ensure they run the latest available software and firmware. Finally, CrowdStrike recommended deploying an advanced, real-time endpoint detection and response (EDR) agent, such as the CrowdStrike Falcon sensor, across the environment, including on servers considered inaccessible from the public internet.
