---
id: "CMP-202610-china-linked-vapor-panda-uses-the-artex-ai-agent-framework-t"
kind: "campaign"
aliases: []
title: "China-linked VAPOR PANDA uses the ARTEX AI agent framework to break into 200+ government, pharma, defense and telecom organisations at once, then plants the BLOODALCHEMY backdoor"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: "2026-10-29T00:00:00+00:00"
first_seen_at: "2026-10-29T23:11:10+00:00"
updated_at: "2026-10-29T23:11:10+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-29T23:11:10+00:00"}]
---

# China-linked VAPOR PANDA uses the ARTEX AI agent framework to break into 200+ government, pharma, defense and telecom organisations at once, then plants the BLOODALCHEMY backdoor

CrowdStrike (2026-10-29) reports that from 2026-10-17 a single ARTEX controller linked to the China-nexus group VAPOR PANDA ran parallel AI-agent intrusions against more than 200 organisations in at least 14 countries. The agents used DeepSeek plus a second, unconfirmed commercial LLM, with a human operator steering them in Chinese. Targets: foreign ministries in Latin America, Europe, Asia and the Middle East, a Middle East interior ministry, US pharmaceutical, semiconductor, defense, nuclear and financial firms and think tanks, and telecoms in the US, Belgium and the Philippines. Post-exploitation is confirmed at 9 organisations, where the BLOODALCHEMY backdoor was installed, and password spraying hit at least 12 more. Methods seen: an unsigned SAML assertion chained with an XXE to query the cloud instance metadata service for an admin role able to run commands on thousands of instances; JSP/PHP web shells; an unauthenticated orchestration service giving root in production containers; LAPS password reads and resource-based constrained delegation; mail-server admin tokens forged with keys from a 2022 directory export that were never rotated; VPN access using configs found in mail and keys from older leaks. The agents were told to look for Windows hosts without the CrowdStrike Falcon sensor. This is separate from the Storm-0940 ARTEX/ConnectWise activity. No new CVE is named; the exact products and flaws behind the SAML/XXE and orchestration-service entry points are unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Hunt for ARTEX markers: command lines containing 'artx' or 'artex', cloud IAM roles with an 'artx' prefix, cloud admin/run-command comments starting 'art18-', and the directory C:\ProgramData\artx5v\.
- Look for traffic to the BLOODALCHEMY C2s nginxmysql[.]com (45.153.126[.]223), sqlserver-sqlite[.]com (89.46.234[.]50) and www[.]ddduuuppp[.]com (192.121.47[.]20).
- Look for these files/hashes (SHA256): svchost.exe that is really a GameHook binary 49fe70419fd19b81ca8d730a6ef7c1ec71b681d60b390761070d42686c7d2068, graphics-hook-filter64.dll 3fb5a9fb3e2cb1d6208966bd4e55d10282d19c7250d827efa560463d60a12ee4, graphics-hook_config.bin 364251838edfcf5ef1107fa692da3c5bd9a540482449f645992830134bf807ab; svchost.exe outside System32.
- Review cloud logs for instance-metadata credential use from web apps, and for unusual mass run-command activity across instances.
- Look for new JSP/PHP web shells, Chisel or SoftEther tunnels, and password spraying against SSO, mail and VPN.

## Fix

- Rotate signing keys, preauthentication keys and service credentials after any suspected data exposure, including keys that appear in old backups and directory exports (for example mail-server exports).
- Enforce SAML signature validation in your SAML service providers, and turn off XML external entity processing in XML parsers.
- Require IMDSv2 on cloud instances and limit which roles can run commands on instances, and on how many.
- Put authentication on internal orchestration and container management services, and patch internet-facing appliances and long-lived Linux servers.
- Make sure EDR runs on every server, including ones believed unreachable from the internet. Block the listed C2 domains and IPs.

## Timeline

- 2026-10-29T23:11:10+00:00 analyst

## Documents

- [describes] VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign (CrowdStrike) https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/
- [describes] @cyb3rops: more ARTEX : https://t.co/PCvCn3Kj3O https://x.com/cyb3rops/status/2115938387945525412
- [describes] @cyb3rops: more ARTEX activity: https://t.co/SpJWen7V4G https://x.com/cyb3rops/status/2115934126394241442

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_