VAPOR PANDA / ARTEX - An Operator Steering an Agent Graph → 200+ Organizations in 11 Days → SAML and XXE Chains → A Metadata Role Over Thousands of Instances → BLOODALCHEMY at Two Ministries
CrowdStrike OverWatch saw this campaign begin on October 17, 2026. Over the next 11 days, it reports, the China-nexus adversary VAPOR PANDA used the ARTEX agentic framework against more than 200 organizations in at least 14 countries, including foreign ministries, US semiconductor, defense and think tank organizations, and telecommunications providers. CrowdStrike Intelligence confirmed post-exploitation at nine organizations, and says password spraying and credential scanning hit at least 12 more. The headline figure of about 140 compromised targets comes from CrowdStrike's comments to CyberScoop, where about 70% of targets were either confirmed or showed moderate-confidence evidence of intrusion. CrowdStrike's report and that interview measure different things, so this page uses nine for confirmed intrusions. CrowdStrike states that this campaign is separate from the ARTEX activity Microsoft attributes to Storm-0940, and that VAPOR PANDA has not previously been seen using AI-driven intrusion tooling. Adam Meyers of CrowdStrike told CyberScoop that the attacks showed nothing new in technique. What changed is the rate: Meyers puts typical hands-on activity at up to about 40 commands an hour, and said ARTEX could exceed 1,500.
ARTEX coordinates a main agent with planner and worker agents over a shared graph of facts, findings and goals. CrowdStrike says the operation ran primarily on the DeepSeek model, with a second, subscription-based commercial model it could not confirm. One intrusion's planning agents consumed on the order of 1.4 billion input tokens.
This was not an unattended system. Recovered transcripts show Chinese-language instructions labeled as human input, directing agents to write web shells, extract domain administrator passwords and inventory endpoint sensor coverage. CrowdStrike says the operator intervened only to steer at decision points, and that this breadth likely enables a single operator to apply more techniques against more targets at once.
Models: primarily DeepSeek, plus a second unconfirmed commercial model
Scale marker: about 1.4 billion input tokens for one intrusion's planning agents
Human role: steering at decision points, in Chinese-language instructions
CrowdStrike describes exploitation of public-facing applications and misuse of valid accounts, with agents pursuing several attack paths at once across web applications, cloud services, container environments, Active Directory, and mail and VPN infrastructure. When one path failed they switched to another.
One case chained an unsigned Security Assertion Markup Language assertion with an XML external entity flaw. CyberScoop reports requests as often as every 10 seconds, with multiple paths running concurrently.
Example chain: unsigned SAML assertion plus XXE
Tempo: requests as often as every 10 seconds, per CyberScoop
Also seen: password spraying and credential scanning at 12 or more further organizations
Against a Greek government entity, the operator gave the agent a 2022 directory export containing authentication keys that had likely not been rotated since. The agent used them to forge an administrator token, then used VPN configurations and a VPN client key, which the operator described as coming from a May 2024 email leak, to reach the internal network.
The detail worth noting is where the keys came from. A person supplied the material, and the agent did the mechanical work of turning it into a foothold.
Forged: an administrator token
Reached: the internal network, with VPN configurations and a client key the operator said came from a leak
This is the most directly cloud-focused step in the report. The agent queried the cloud Instance Metadata Service at a US pharmaceutical organization and obtained a role capable of issuing administration commands to thousands of instances, then escalated to an enterprise administrator account.
Cloud security teams have known this path for years. A workload's instance role is reachable by anything running on the workload, and a role that can command a fleet turns one compromised host into all of them.
Obtained: a role able to issue administration commands to thousands of instances
Then: escalation to an enterprise administrator account
Control: IMDSv2, plus instance roles scoped to one workload
A second pharmaceutical intrusion abused an unauthenticated orchestration service to gain root access in a production container environment. On the Windows side, reported actions include reading LAPS passwords and using resource-based constrained delegation to impersonate a privileged account.
Neither technique is rare. Seeing both in one campaign shows how many kinds of environment this operation covered with agents doing the work.
Active Directory: LAPS passwords read, resource-based constrained delegation
Pattern: the same operator working cloud, container and domain targets
At a global pharmaceutical organization, the operator instructed the agents to find Windows machines in the domain with no Falcon sensor, judging by process lists and folder contents, so follow-on activity could concentrate on unprotected hosts. Coverage gaps became a target list.
Traffic ran through Tor, SOCKS proxies and a compromised relay, with tunneling over Chisel and SoftEther.
Purpose: concentrate follow-on activity on unmonitored machines
Network: Tor, SOCKS proxies, a compromised relay, Chisel, SoftEther
CrowdStrike reports the BLOODALCHEMY backdoor, first publicly documented in October 2023, at a Middle East interior ministry and a Latin American foreign ministry. The adversary renamed a legitimate GameHook binary to svchost.exe and used it to load a malicious DLL, which decrypted the payload.
Mailboxes on a compromised mail server were also read. That fits an actor CrowdStrike says has mainly pursued long-term access to government, think tank, energy and extractive organizations since 2021. The agents sped up the path to that goal, and the goal itself stayed the same.
Loader: legitimate GameHook binary renamed svchost.exe, malicious DLL
Collection: mailboxes read on a compromised mail server
Status: CyberScoop reported the campaign as active on October 30
🛡 How to Defend Against This Chain
C:\ProgramData\artx5v\ directory. Indicators like these change quickly. A more durable signal is tempo: command rates far above the 40 an hour CrowdStrike gives for hands-on work are measurable in any environment.