CrowdStrike Says China-Nexus VAPOR PANDA Used the ARTEX AI Agent Framework Against More Than 200 Organizations in 11 Days, With an Operator Telling the Agents to Find Windows Machines Without Falcon

LONDON - A China-nexus espionage group that CrowdStrike tracks as VAPOR PANDA used the ARTEX AI agent framework against more than 200 organizations worldwide beginning Oct. 17, running intrusions at several targets at once while a human operator stepped in only at decision points, the company said on Thursday. At a global pharmaceutical company, that operator told the agents to find the Windows machines that lacked CrowdStrike's own endpoint sensor.

The targets included foreign ministries in Latin America, Europe, Asia and the Middle East; semiconductor, defense and think tank organizations in the United States; and telecommunications providers in several regions. CrowdStrike OverWatch saw the activity come from a single ARTEX controller, which CrowdStrike Intelligence linked to VAPOR PANDA infrastructure, against entities in at least 14 countries over an 11-day window. The controller intermittently exposed the group's tooling, target files and ARTEX agent transcripts, which is how the company reconstructed the campaign.

CrowdStrike said the campaign is separate from the ARTEX activity Microsoft and others reported this month under the Storm-0940 designation, and called it "an escalation in China-nexus use of AI agents, from single intrusions to multiple simultaneous engagements directed by a human operator." It is VAPOR PANDA's first observed use of AI-driven intrusion tooling.

A sensor check written into the workflow

ARTEX coordinates a main agent with subordinate planner and worker agents over a shared graph of facts, findings and goals. The recovered transcripts show the operator issuing instructions in Chinese, labeled "human instruction" and timestamped in China Standard Time, directing the agents to write web shells, extract domain administrator passwords and inventory endpoint sensor coverage.

At the pharmaceutical company, the instruction, in CrowdStrike's translation, was to "find Windows machines in the domain without Falcon, judging by tasklist and folder listings." The word the operator used for Falcon is PRC red-team slang for the CrowdStrike sensor. CrowdStrike said building that check into the agentic workflow lets the adversary "concentrate follow-on activity on unprotected hosts."

For detection teams, that is the practical lesson. An attacker running agents at this pace is looking for the gaps in coverage first, so an accurate list of hosts without an EDR agent, including servers assumed to be unreachable from the internet, is also a list of where an intrusion is most likely to go next.

What the agents did

CrowdStrike confirmed post-exploitation activity at nine organizations, where the group gained access, deployed a backdoor and followed up with credential spraying, network scanning and reconnaissance. It saw password spraying and credential scanning against at least 12 more, including U.S. think tanks and European government entities. The group conducted extensive intrusions at the foreign ministries of two Latin American countries, likely compromised a third, compromised a Middle Eastern interior ministry and targeted 19 U.S. organizations in the pharmaceutical, semiconductor, defense, nuclear and financial sectors. It also compromised telecommunications providers in the United States, Belgium and the Philippines.

The transcripts pair automation with familiar tradecraft. At one U.S. pharmaceutical company, an agent chained an unsigned SAML assertion and an XML external entity flaw to query the cloud instance metadata service, obtained a role that could issue administration commands to thousands of instances and then recovered an enterprise administrator account. At a second, an agent deployed web shells, abused an unauthenticated orchestration service to get root in a production container environment, read LAPS passwords and abused resource-based constrained delegation to impersonate a privileged account. Against a Greek government entity, the operator handed the agent a 2022 directory export from the organization's mail server containing authentication keys that had likely never been rotated; the agent forged an administrator token, read mailboxes and used VPN configurations found in a user's sent mail to reach the internal network.

VAPOR PANDA ran ARTEX mainly on the Chinese-developed DeepSeek model, with a second, subscription-based commercial model that CrowdStrike could not identify. In a single intrusion, the planning agents consumed on the order of 1.4 billion input tokens.

The backdoor and the hunt markers

At the Middle Eastern interior ministry and a Latin American foreign ministry, the group deployed BLOODALCHEMY, a backdoor first publicly documented in October 2023. A legitimate GameHook binary renamed svchost.exe loaded a malicious DLL, graphics-hook-filter64.dll, which decrypted the payload file graphics-hook_config.bin. The implant carries the internal project path D:\ProjectX\Merman_New\. CrowdStrike said those indicators and the backdoor's command-and-control infrastructure do not appear in earlier public ARTEX reporting, and it published hashes and domains for them.

CrowdStrike's hunting guidance names specific ARTEX markers: command-line parameters containing artx or artex strings, artx-prefixed cloud roles, art18- administration-command comments and the C:\ProgramData\artx5v\ directory. It also recommends rotating signing keys, preauthentication keys and service credentials after any suspected exposure, "including keys contained in historical backups and directory exports"; enforcing SAML signature validation; requiring IMDSv2; limiting which instances cloud roles can send commands to; and patching internet-facing appliances, particularly long-lived Linux servers.

The ATT&CK mapping gives SOC teams more to search on: forged mail server administrator tokens, password spraying against government, think tank and corporate accounts, security software discovery for the sensor inventory, mailbox reads on a compromised mail server, traffic routed through Tor, SOCKS proxies and a compromised relay, and tunnels built with Chisel and SoftEther.

CrowdStrike assessed that China-nexus groups will highly likely keep adopting frameworks like ARTEX over the next 12 months, pairing them with commercial models so that small teams can run intrusions against many targets at once.