{"id":"CMP-202610-china-linked-vapor-panda-uses-the-artex-ai-agent-framework-t","kind":"campaign","aliases":[],"related":["CMP-202610-stolen-connectwise-cloud-backup-skykick-app-credential-used-"],"title":"China-linked VAPOR PANDA uses the ARTEX AI agent framework to break into 200+ government, pharma, defense and telecom organisations at once, then plants the BLOODALCHEMY backdoor","description":null,"summary":"CrowdStrike (2026-10-29) reports that from 2026-10-17 a single ARTEX controller linked to the China-nexus group VAPOR PANDA ran parallel AI-agent intrusions against more than 200 organisations in at least 14 countries. The agents used DeepSeek plus a second, unconfirmed commercial LLM, with a human operator steering them in Chinese. Targets: foreign ministries in Latin America, Europe, Asia and the Middle East, a Middle East interior ministry, US pharmaceutical, semiconductor, defense, nuclear and financial firms and think tanks, and telecoms in the US, Belgium and the Philippines. Post-exploitation is confirmed at 9 organisations, where the BLOODALCHEMY backdoor was installed, and password spraying hit at least 12 more. Methods seen: an unsigned SAML assertion chained with an XXE to query the cloud instance metadata service for an admin role able to run commands on thousands of instances; JSP/PHP web shells; an unauthenticated orchestration service giving root in production containers; LAPS password reads and resource-based constrained delegation; mail-server admin tokens forged with keys from a 2022 directory export that were never rotated; VPN access using configs found in mail and keys from older leaks. The agents were told to look for Windows hosts without the CrowdStrike Falcon sensor. This is separate from the Storm-0940 ARTEX/ConnectWise activity. No new CVE is named; the exact products and flaws behind the SAML/XXE and orchestration-service entry points are unknown.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-10-29T23:11:10+00:00","products":[],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"- Hunt for ARTEX markers: command lines containing 'artx' or 'artex', cloud IAM roles with an 'artx' prefix, cloud admin/run-command comments starting 'art18-', and the directory C:\\ProgramData\\artx5v\\.\n- Look for traffic to the BLOODALCHEMY C2s nginxmysql[.]com (45.153.126[.]223), sqlserver-sqlite[.]com (89.46.234[.]50) and www[.]ddduuuppp[.]com (192.121.47[.]20).\n- Look for these files/hashes (SHA256): svchost.exe that is really a GameHook binary 49fe70419fd19b81ca8d730a6ef7c1ec71b681d60b390761070d42686c7d2068, graphics-hook-filter64.dll 3fb5a9fb3e2cb1d6208966bd4e55d10282d19c7250d827efa560463d60a12ee4, graphics-hook_config.bin 364251838edfcf5ef1107fa692da3c5bd9a540482449f645992830134bf807ab; svchost.exe outside System32.\n- Review cloud logs for instance-metadata credential use from web apps, and for unusual mass run-command activity across instances.\n- Look for new JSP/PHP web shells, Chisel or SoftEther tunnels, and password spraying against SSO, mail and VPN.","fix":"- Rotate signing keys, preauthentication keys and service credentials after any suspected data exposure, including keys that appear in old backups and directory exports (for example mail-server exports).\n- Enforce SAML signature validation in your SAML service providers, and turn off XML external entity processing in XML parsers.\n- Require IMDSv2 on cloud instances and limit which roles can run commands on instances, and on how many.\n- Put authentication on internal orchestration and container management services, and patch internet-facing appliances and long-lived Linux servers.\n- Make sure EDR runs on every server, including ones believed unreachable from the internet. Block the listed C2 domains and IPs.","status":"open","published_at":"2026-10-29T00:00:00+00:00","first_seen_at":"2026-10-29T23:11:10+00:00","triaged_at":"2026-10-29T23:11:10+00:00","updated_at":"2026-10-29T23:11:10+00:00","category":"infrastructure","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-0940':266B '-10':53B,59B '-17':60B '-202610':30A '-29':54B '12':165B '14':88B '200':15A,83B '2022':227B '2026':52B,58B '9':151B 'abl':188B 'access':235B 'activ':268B 'admin':186B,220B 'agent':10A,40A,78B,91B,247B 'ai':9A,39A,77B 'ai-ag':76B 'america':113B 'artex':8A,38A,45A,63B 'artex/connectwise':267B 'asia':115B 'assert':172B 'backdoor':28A,156B 'base':214B 'behind':279B 'belgium':141B 'bloodalchemi':27A,155B 'bloodalchemy':46A 'break':13A 'campaign':47B 'chain':173B 'china':2A,32A,69B 'china-link':1A 'china-linked-vapor-panda-uses-the-artex-ai-agent-framework-t':31A 'china-nexus':68B 'chines':107B 'cloud':180B 'cmp':29A 'command':191B 'commerci':98B 'config':237B 'confirm':149B 'constrain':215B 'contain':207B 'control':64B 'countri':89B 'crowdstrik':51B,257B 'cve':271B 'deepseek':93B 'defens':18A,128B 'deleg':216B 'directori':228B 'earli':49B 'early-warn':48B 'east':119B,122B 'entri':286B 'europ':114B 'exact':275B 'exploit':147B 'export':229B 'falcon':258B 'financi':131B 'firm':132B 'flaw':278B 'foreign':109B 'forg':222B 'found':238B 'framework':11A,41A 'give':203B 'govern':16A 'group':71B 'hit':162B 'host':254B 'human':102B 'instal':158B 'instanc':181B,195B 'interior':123B 'intrus':79B 'jsp/php':196B 'key':224B,242B 'lap':208B 'latin':112B 'leak':245B 'least':87B,164B 'link':3A,65B 'linked':33A 'llm':99B 'look':251B 'mail':218B,240B 'mail-serv':217B 'metadata':182B 'method':167B 'middl':118B,121B 'ministri':110B,124B 'name':273B 'never':232B 'new':270B 'nexus':70B 'nuclear':129B 'older':244B 'oper':103B 'orchestr':201B,284B 'orchestration-servic':283B 'organis':21A,84B,152B 'panda':5A,35A,44A,73B 'parallel':75B 'password':160B,209B 'pharma':17A 'pharmaceut':126B 'philippin':144B 'plant':25A 'plus':94B 'point':287B 'post':146B 'post-exploit':145B 'product':206B,276B 'queri':178B 'ran':74B 'read':210B 'report':55B 'resourc':213B 'resource-bas':212B 'role':187B 'root':204B 'rotat':233B 'run':190B 'saml':171B 'saml/xxe':281B 'second':96B 'seen':168B 'semiconductor':127B 'sensor':259B 'separ':262B 'server':219B 'servic':183B,202B,285B 'shell':198B 'singl':62B 'spray':161B 'steer':104B 'storm':265B 't':42A 'tank':135B 'target':108B 'telecom':20A,137B 'the':37A 'think':134B 'thousand':193B 'token':221B 'told':249B 'unauthent':200B 'unconfirm':97B 'unknown':289B 'unsign':170B 'us':125B,140B 'use':6A,92B,236B 'uses':36A 'vapor':4A,34A,43A,72B 'vpn':234B 'warn':50B 'web':197B 'window':253B 'without':255B 'xxe':176B","nicknames":["VAPOR PANDA","ARTEX","BLOODALCHEMY"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-10-29T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202610-china-linked-vapor-panda-uses-the-artex-ai-agent-framework-t","url":null,"severity":null,"published_at":"2026-10-29T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-29T23:11:10+00:00","fetched_at":"2026-10-29T23:11:10+00:00","note":null}],"documents":[{"id":19904,"url":"https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/","title":"VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign (CrowdStrike)","kind":"blog","source":"analyst","publisher":null,"text":"CrowdStrike OverWatch: from 2026-10-17, a single ARTEX controller linked to China-nexus VAPOR PANDA ran parallel AI-agent intrusions (DeepSeek + a second commercial LLM, human operator steering in Chinese) against 200+ organisations in 14+ countries over 11 days: foreign ministries (LatAm, Europe, Asia, Middle East), US pharma/semiconductor/defense/nuclear/finance/think tanks, telecoms in US, Belgium, Philippines. Post-exploitation confirmed at 9 orgs with BLOODALCHEMY backdoor (GameHook binary renamed svchost.exe sideloads graphics-hook-filter64.dll, decrypts graphics-hook_config.bin; path D:\\ProjectX\\Merman_New\\); password spraying at 12+ more. Techniques: unsigned SAML assertion + XXE to query cloud IMDS for an admin role, web shells (JSP/PHP), unauthenticated orchestration service to root in containers, LAPS reads, RBCD impersonation, forging mail admin tokens with unrotated keys from old directory exports, VPN configs from mail; agents told to find hosts without Falcon. Separate from Storm-0940 ARTEX activity. Hunt: artx/artex in command lines, artx-prefixed cloud roles, art18- admin-command comments, C:\\ProgramData\\artx5v\\. IOCs: nginxmysql[.]com 45.153.126[.]223; sqlserver-sqlite[.]com 89.46.234[.]50; www[.]ddduuuppp[.]com 192.121.47[.]20; SHA256 49fe70419fd19b81ca8d730a6ef7c1ec71b681d60b390761070d42686c7d2068 (renamed svchost.exe), 3fb5a9fb3e2cb1d6208966bd4e55d10282d19c7250d827efa560463d60a12ee4 (loader DLL), 364251838edfcf5ef1107fa692da3c5bd9a540482449f645992830134bf807ab (payload). Tunnels: Chisel, SoftEther, Tor/SOCKS. Recs: rotate keys incl. those in old backups/exports, enforce SAML signature validation, require IMDSv2, restrict cloud command-execution roles, patch internet-facing appliances, EDR on all servers.","published_at":"2026-10-29T00:00:00+00:00","relation":"describes","confidence":null,"note":null},{"id":19779,"url":"https://x.com/cyb3rops/status/2115938387945525412","title":"@cyb3rops: more ARTEX : https://t.co/PCvCn3Kj3O","kind":"post","source":"x","publisher":null,"text":"more ARTEX : https://t.co/PCvCn3Kj3O\n\nlikes 0 reposts 0","published_at":"2026-10-29T22:46:38+00:00","relation":"describes","confidence":null,"note":null},{"id":19766,"url":"https://x.com/cyb3rops/status/2115934126394241442","title":"@cyb3rops: more ARTEX activity: https://t.co/SpJWen7V4G","kind":"post","source":"x","publisher":null,"text":"more ARTEX activity: https://t.co/SpJWen7V4G\n\nlikes 0 reposts 0","published_at":"2026-10-29T22:29:42+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}