Vapor Panda ARTEX Attacks: How a China-Based Group Used AI Agents Against 200+ Organizations, and What to Check

CrowdStrike says a China-based hacking group it calls Vapor Panda used ARTEX, an AI-driven attack framework, against more than 200 organizations worldwide, starting October 17, 2026. This matters to businesses because in CrowdStrike's examples the AI agents mostly got in through ordinary gaps: keys that were never rotated, sign-in and cloud settings that were never tightened, and machines with no monitoring.

CrowdStrike published its report on Thursday, October 29, 2026. Below we separate what the report confirms from what it does not say, followed by a checklist for this week.

What happened in the Vapor Panda ARTEX campaign

Here is what CrowdStrike's report states:

• Who: Vapor Panda, which CrowdStrike describes as a China-based targeted intrusion adversary. CrowdStrike says that since 2021 the group has mainly targeted government, think tank, energy and extractive organizations in Europe, North America, Oceania and the UK.
• When: The activity began October 17, 2026. CrowdStrike's OverWatch team watched a single ARTEX controller over an 11-day window.
• Scale: More than 200 organizations, in at least 14 countries.
• The tool: ARTEX runs a main agent alongside "planner" and "worker" agents. They share findings and goals, try several attack paths at once and switch when one fails. In this campaign it ran mainly on the DeepSeek AI model, plus a second subscription-based commercial model that CrowdStrike could not confirm. The planning agents in one intrusion used on the order of 1.4 billion input tokens.
• A human was in charge: Recovered transcripts show an operator giving instructions in Chinese, timestamped in China Standard Time, and stepping in mainly at decision points. The instructions included writing web shells, extracting domain admin passwords and listing which machines had endpoint security software.
• A first for this group: CrowdStrike says this is Vapor Panda's first observed use of AI-driven intrusion tooling. With it, the group's targeting expanded into the pharmaceutical, semiconductor, nuclear, defense and foreign ministry sectors, across new regions.

Who was compromised and who was only targeted

CrowdStrike keeps these groups separate, and anyone repeating the story should too.

CrowdStrike confirmed post-exploitation activity at nine organizations. Across those nine, the activity included deploying a backdoor called BLOODALCHEMY, credential spraying, network scanning and reconnaissance. The report names two specific BLOODALCHEMY deployments, at the Middle East interior ministry and at a Latin American foreign ministry. It does not say all nine received the backdoor.

How the ARTEX AI agents got in

The report's examples show where the agents found their openings. In several of them, the opening was an old credential or a setting nobody had tightened:

• A U.S. pharmaceutical organization: Agents chained an unsigned SAML sign-in assertion with an XXE flaw to reach the cloud instance metadata service. From there they got a cloud role that could run commands on thousands of instances, and they eventually recovered an enterprise admin account.
• A second U.S. pharmaceutical organization: Agents deployed web shells and abused an orchestration service that required no login to get root in a production container environment. They also read LAPS passwords and impersonated a privileged account.
• A Greek government entity: Agents used directory export keys from 2022, likely never rotated, to forge an admin token and read mailboxes. Then they used VPN settings found in sent mail, plus a VPN client key from a May 2024 email leak, to reach the internal network.
• A global pharmaceutical company: The operator told agents to find domain Windows machines that did not have the CrowdStrike Falcon sensor installed.

Is this the same as the Storm-0940 ARTEX activity?

No. CrowdStrike says this campaign "is separate from the ARTEX activity recently reported by industry sources under the Storm-0940 designation." Microsoft reported on Storm-0940 on October 21, 2026, calling it a China-state aligned actor. Microsoft describes ARTEX as "an open-source penetration testing framework that can use any AI model." It says Storm-0940 used ARTEX to speed up scanning, reconnaissance, password spraying and abuse of OAuth applications, and that some of those attacks reached privileged cloud access within three hours of first targeting.

So two separate China-linked groups, reported by two different security companies, have now been seen running the same AI framework.

What is not known

• Victim names: CrowdStrike does not name the victims or say what data was taken.
• The 19 U.S. organizations: The report lists them as targeted. Apart from the pharmaceutical examples above, it does not say which of them, if any, were breached.
• First access: For most of the 200+ organizations, the report does not explain how the agents first got in.
• The second AI model: CrowdStrike could not confirm which commercial model was used.

Why this matters for a company network

Your company does not have to be a foreign ministry for this to matter. Microsoft's Storm-0940 report lists targets in manufacturing, legal, financial services, technology, energy and other industries. ARTEX is publicly available, and the agents run many attacks at once without getting tired. The weak spots in these reports are common in companies of every size: a signing key exported years ago, a sign-in setting that accepts unsigned assertions, a VPN file sitting in someone's sent mail, a server that never got endpoint protection. When an automated tool can go from first contact to privileged cloud access in hours, those gaps get found faster than a monthly review will catch them.

What to do this week

These checks come from CrowdStrike's recommendations, plus one mailbox check we suggest based on the Greek case.

Vapor Panda and ARTEX questions people are asking

What is ARTEX?

ARTEX is a penetration testing framework that uses AI agents to automate attacks, from reconnaissance through exploitation. Microsoft describes it as open source and able to use any AI model. CrowdStrike and Microsoft have each reported a China-linked group misusing it.

Who is Vapor Panda?

Vapor Panda is CrowdStrike's name for a China-based targeted intrusion adversary that it has tracked since 2021. Its usual targets have been government, think tank, energy and extractive organizations.

Is ARTEX malware?

Not on its own. It is a testing tool that attackers misused. The malware CrowdStrike found in this campaign is BLOODALCHEMY, a backdoor that was first publicly documented in October 2023.

How do I know if my company was hit?

Search your logs for the ARTEX markers and BLOODALCHEMY indicators in CrowdStrike's report. If you find a match, preserve the evidence and bring in incident response before you start deleting anything.

Do AI attacks need new defenses?

Mostly no. The examples relied on unrotated keys, weak sign-in settings and gaps in monitoring. The difference is speed, so closing those gaps now matters more than it used to.

The bigger lesson

AI did not give these attackers new weaknesses to exploit. It let them find the old ones faster and at scale. A key that was never rotated or a server nobody monitors used to be a risk that might be found someday. Against automated agents, it is likely to be found soon.

If you want a second set of eyes on your keys, sign-in settings and server coverage, see security hardening or request a quote.

Get security alerts like this by email, along with our free checklist, at /security-alerts.

Sources: CrowdStrike: VAPOR PANDA Uses ARTEX to Scale a Global Espionage Campaign; Microsoft Security: Storm-0940 uses ARTEX agentic AI.