VAPOR PANDA uses ARTEX and DeepSeek to scale global espionage campaign

1. Executive summary

CrowdStrike OverWatch reported on 2026-10-29 that VAPOR PANDA used the ARTEX agentic framework, run primarily on the Chinese DeepSeek LLM plus a second unconfirmed commercial LLM, to conduct parallel intrusions against more than 200 organisations in at least 14 countries from 2026-10-17 over an 11-day window. Confirmed post-exploitation activity occurred at nine organisations, where the adversary deployed the BLOODALCHEMY backdoor and ran credential spraying, network scanning and reconnaissance; password spraying and credential scanning hit at least 12 more. Targets include foreign, interior and prime ministerial offices in Europe, Latin America, Asia and the Middle East, plus pharmaceutical, semiconductor, defence, nuclear, financial and telecommunications organisations. No CVE is associated with this item, so there is no CVSS score, EPSS estimate or CISA KEV entry to apply; the risk is from stolen credentials, unrotated keys and internet-facing appliances rather than a named vulnerability. For EMEA financial services the exposure is indirect but concrete: the campaign touched financial-sector organisations and European government entities, and the tradecraft it used (forged SAML tokens, unrotated directory-export keys, VPN material recovered from mail) maps directly onto identity and third-party infrastructure that banks rely on.

2. Regulatory framing

3. Technical analysis & attack chain

CrowdStrike attributes the controller to VAPOR PANDA infrastructure. VAPOR PANDA has no MITRE ATT&CK profile in the data supplied with this advisory, so the attribution is unconfirmed; treat it as the reporting vendor's assessment, not an established fact. The campaign is stated to be separate from the ARTEX activity reported under the Storm-0940 designation.

Confirmed steps, as reported:

1. A single ARTEX controller, linked by CrowdStrike Intelligence to VAPOR PANDA infrastructure, directed exploitation against entities in at least 14 countries from 2026-10-17 over 11 days. The controller intermittently exposed adversary tooling, target files and ARTEX agent transcripts in open directories.
2. ARTEX coordinated a main agent with subordinate planner and worker agents over a shared graph of facts, findings and goals, advancing each engagement from initial access through host reconnaissance and lateral movement. A human operator issued instructions in Chinese, labelled 【人类指令】 ("human instruction") and timestamped in China Standard Time, steering the agents at decision points.
3. Initial access combined exploitation of public-facing applications (SAML assertion handling, XXE) with valid accounts (stolen VPN configurations, leaked credentials) and external remote services (VPN into internal networks).
4. At a U.S. pharmaceutical organisation the agent chained an unsigned SAML assertion and an XXE flaw to query the cloud Instance Metadata Service, obtained a role able to issue administration commands to thousands of instances, then escalated to recover an enterprise administrator account.
5. At a second U.S. pharmaceutical organisation the agent deployed web shells, abused an unauthenticated orchestration service to get root in a production container, read LAPS passwords, and abused resource-based constrained delegation to impersonate a privileged account.
6. Against a Greek government entity the operator supplied a 2022 directory export from the organisation's mail server containing authentication keys likely not rotated since the export. The agent forged an administrator token, read mailboxes, then used VPN configurations recovered from a user's sent mail and a VPN client key the operator described as coming from a May 2024 email leak to reach the internal network.
7. At a Middle East interior ministry and a Latin America foreign ministry, VAPOR PANDA deployed BLOODALCHEMY. A legitimate GameHook binary renamed svchost.exe loaded a malicious DLL, graphics-hook-filter64.dll, which decrypted the payload file graphics-hook_config.bin. The implant carries the internal project path D:\ProjectX\Merman_New.
8. Follow-on activity at the nine confirmed organisations was credential spraying, network scanning and reconnaissance. Password spraying and credential scanning also hit at least 12 further organisations, including U.S. think tanks and European government entities.

Command and control used Tor, SOCKS proxies and a compromised relay, with traffic tunnelled via Chisel and SoftEther. BLOODALCHEMY communicated with VAPOR PANDA infrastructure at the domains and IPs in §5.

The operator also directed the agents to evade endpoint defences. At a global pharmaceutical organisation the instruction was "在域里寻找没有装猎鹰的windows机器，从tasklist和文件夹目录判断" ("find Windows machines in the domain without Falcon, judging by tasklist and folder listings"), using 猎鹰, PRC red-team slang for the CrowdStrike Falcon sensor. Sensor coverage checks were built into the agentic workflow so follow-on activity concentrated on unprotected hosts.

Scale: in a single intrusion the planning agents consumed on the order of 1.4 billion input tokens. The second commercial LLM is subscription-based and CrowdStrike could not confirm its identity. The whole operation rests on a single vendor's telemetry and reporting; the BLOODALCHEMY C2 indicators are stated to be absent from prior public ARTEX reporting, so they are single-sourced and should be verified before enforcement.

4. Mitigation & containment

P1 (within 24h)

• Rotate signing keys, preauthentication keys and service credentials wherever a directory export, backup or mail archive may have been exposed. The Greek engagement turned on a 2022 directory export whose keys had likely never been rotated; assume any historical export is compromised until proven otherwise.
• Enforce SAML signature validation and reject unsigned assertions at every identity provider and relying party. This closes the exact path used at the first pharmaceutical target.
• Require IMDSv2 on all cloud instances and restrict cloud roles' command-execution permissions to the minimum set of instances. The first pharmaceutical intrusion reached a role able to command thousands of instances through the metadata service.
• Hunt for ARTEX markers: command-line parameters containing artx or artex, artx-prefixed cloud roles, art18- administration-command comments, and the directory C:\ProgramData\artx5v. Isolate any host that matches.

P2 (within 72h)

• Search mail stores and sent items for VPN configuration files and client keys, and revoke any VPN credential found in mail. The Greek engagement reached the internal network using VPN material recovered from a user's sent mail and a key from a May 2024 leak.
• Audit container orchestration services for unauthenticated endpoints and require authentication. The second pharmaceutical intrusion abused an unauthenticated orchestration service for root in production.
• Review resource-based constrained delegation assignments and remove any that let a service account impersonate a privileged account.
• Restrict LAPS password read access to the accounts that need it, and alert on reads from unexpected principals.

P3 (within 7 days)

• Patch internet-facing appliances, particularly long-lived Linux-based servers, and bring them to the latest available software and firmware.
• Deploy a real-time EDR agent on every host, including servers considered unreachable from the internet. The adversary specifically selected Windows machines without the Falcon sensor, so partial coverage is a targeting signal.
• Block the BLOODALCHEMY C2 domains and IPs in §5 at egress, and alert on Chisel and SoftEther tunnelling to external endpoints.

5. Indicators of compromise

domain  nginxmysql[.]com
ipv4  45.153.126[.]223
domain  sqlserver-sqlite[.]com
ipv4  89.46.234[.]50
domain  www[.]ddduuuppp[.]com
ipv4  192.121.47[.]20
sha256  49fe70419fd19b81ca8d730a6ef7c1ec71b681d60b390761070d42686c7d2068
sha256  3fb5a9fb3e2cb1d6208966bd4e55d10282d19c7250d827efa560463d60a12ee4
sha256  364251838edfcf5ef1107fa692da3c5bd9a540482449f645992830134bf807ab

The three hashes correspond to the GameHook binary renamed svchost.exe, the loader DLL graphics-hook-filter64.dll, and the payload file graphics-hook_config.bin respectively. All indicators are single-sourced to CrowdStrike and should be verified before enforcement.

6. Detection

rule BLOODALCHEMY_GameHook_Loader_Chain
{
    meta:
        author = "Adverse Trace"
        date = "2026-10-30"
        reference = "https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/"
        description = "Detects BLOODALCHEMY loader DLL and payload staged alongside a renamed GameHook binary"
    strings:
        $dll = "graphics-hook-filter64.dll" ascii wide
        $cfg = "graphics-hook_config.bin" ascii wide
        $proj = "D:\\ProjectX\\Merman_New\\" ascii wide
    condition:
        uint16(0) == 0x5A4D and 2 of them
}

title: ARTEX Agent Framework Marker Activity
id: 8f3c2a10-4b7e-4c1d-9a2e-6d5f0b1c7e34
status: experimental
description: Detects ARTEX command-line markers, artx-prefixed cloud roles, administration-command comments and the ARTEX working directory
author: Adverse Trace
date: 2026/10/30
references:

    - https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/
logsource:
    category: process_creation
    product: windows
detection:
    selection_cmdline:
        CommandLine|contains:

            - 'artx'
            - 'artex'
    selection_role:
        CommandLine|contains: 'artx-'
    selection_comment:
        CommandLine|contains: 'art18-'
    selection_dir:
        CommandLine|contains: 'C:\ProgramData\artx5v\'
    condition: 1 of selection_*
falsepositives:

    - Legitimate software containing the substring artx in a path or argument; tune against known-good inventory
level: high

7. Sources

• CrowdStrike, "VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign", https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/, 2026-10-29.
• Microsoft Security Blog, "Storm-0940 uses ARTEX agentic AI in ConnectWise supply chain compromise", https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/, 2026-10-21 (cited by CrowdStrike as separate ARTEX activity).
• Elastic Security Labs, "Disclosing the BLOODALCHEMY backdoor", https://www.elastic.co/security-labs/threat-command/disclosing-the-bloodalchemy-backdoor (cited by CrowdStrike for prior BLOODALCHEMY reporting).

8. Adverse Trace position

No CVE, CVSS score, EPSS estimate or CISA KEV entry applies to this item, so severity rests on the campaign's confirmed reach and tradecraft rather than a vulnerability score. The confirmed post-exploitation at nine organisations and the targeting of financial-sector and European government entities put this at high relevance for EMEA financial services clients, with the main exposure through identity, unrotated keys and remote-access material rather than a patchable flaw. The VAPOR PANDA attribution is unconfirmed because no MITRE ATT&CK profile exists for the actor, and the BLOODALCHEMY C2 indicators are single-sourced to CrowdStrike, so we will treat them as hunt leads rather than blocklist entries until a second source corroborates them. Adverse Trace will monitor for further ARTEX reporting and for corroboration of the C2 infrastructure, and will issue an update if the indicator set is confirmed or extended.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.