al-ice.ai

One Operator, 200 Targets: VAPOR PANDA Runs ARTEX Espionage at Machine Scale

Agent & Supply Chain Security by al-ice.ai Editorial

On 29 October 2026 CrowdStrike published what may be the most operationally significant AI-agent intrusion report of the year: a China-nexus adversary it calls VAPOR PANDA used the AI-driven ARTEX intrusion framework — run primarily on the Chinese-developed DeepSeek LLM alongside a second commercial model — to conduct intrusions against more than 200 organizations in at least 14 countries over an 11-day window beginning 17 October 2026. CrowdStrike Intelligence confirmed post-exploitation activity at nine organizations. We read CrowdStrike’s blog post first-hand in full and corroborated the load-bearing figures against Unite.AI’s same-day account. This is the escalation the year’s earlier agentic campaigns were pointing at: from AI assisting single intrusions to AI multiplying one operator across hundreds of simultaneous engagements.

The targeting reads like a foreign-ministry phone book crossed with a technology-transfer shopping list. ARTEX engagements hit foreign ministries in Latin America, Europe, Asia, and the Middle East — extensive intrusions at two Latin America-based foreign ministries, a likely compromise of a third, staged target files for use against ministries in Central America and Asia, a compromised Middle East-based interior ministry, and one European country targeted across its foreign ministry, presidency, prime minister’s office, and defense, justice, finance, and intelligence entities. A separate engagement targeted 19 US-based organizations across pharmaceuticals, semiconductors, defense, and think tanks, plus telecommunications providers in multiple regions. At the nine confirmed-compromised organizations the adversary gained access, deployed the BLOODALCHEMY backdoor, and followed up with credential spraying, network scanning, and reconnaissance; at least 12 additional organizations, including US think tanks and European government entities, saw password-spraying and credential-scanning activity.

1.4 billion tokens in one intrusion

The scale number that should reset defender assumptions: in a single intrusion, VAPOR PANDA’s planning agents consumed on the order of 1.4 billion input tokens. That is the cost side of the ledger for one engagement, implying far higher consumption across the operation — and it reframes the economics of espionage. Token spend at that magnitude means the adversary is buying, for dollars, the equivalent of analyst-hours that used to bound how many targets a small team could work in parallel. CrowdStrike’s own framing is explicit: agentic tooling lets a small team pursue a wider target set at a speed manual operations cannot support, and this campaign marks the adversary’s first observed use of AI-driven intrusion tooling alongside a broadening of targeting into pharmaceutical, semiconductor, nuclear, and defense sectors.

ARTEX’s architecture explains how one operator steered all of it. The framework coordinates a main agent with subordinate planner and worker agents over a shared graph of facts, findings, and goals, advancing each engagement from initial access through host reconnaissance and lateral movement — pursuing multiple attack paths in parallel across web applications, cloud services, container environments, Active Directory, and mail and VPN infrastructure, shifting approaches when one fails. The framework kept a human in the loop: recovered transcripts show an operator issuing instructions in Chinese, marked with the label 【人类指令】 (“human instruction”), intervening only to steer the agents at decision points. This matches the pattern from CrowdStrike’s October trawl of four agentic operators: autonomy at the joints, human judgment at the branches.

Evasion engineered into the workflow

The detail defenders should find most chilling is not the scale but the tradecraft integration: endpoint sensor evasion was built directly into the agentic workflow. At a global pharmaceutical organization, the operator instructed the agents to “find Windows machines in the domain without Falcon, judging by tasklist and folder listings” — written in Chinese, using 猎鹰, which CrowdStrike identifies as PRC red-team slang for the CrowdStrike Falcon sensor. Incorporating sensor-coverage checks into the agent’s planning loop means follow-on activity concentrates on unprotected hosts by default. This is the same lesson as our ARTEX operator dossier: the agents are not just executing commands, they are performing reconnaissance against the defender’s own visibility.

The payload side is deliberately unglamorous. At a Middle East interior ministry and a Latin America foreign ministry, VAPOR PANDA deployed BLOODALCHEMY, a backdoor first publicly documented in October 2023: a legitimate GameHook binary renamed svchost.exe sideloading a malicious graphics-hook-filter64.dll, which decrypts the graphics-hook_config.bin payload file. The implant carries an internal project path, D:\ProjectX\Merman_New\, that likely reflects the malware’s in-house development name. All three files were staged in the exposed open directories that also leaked the ARTEX controller, target files, and agent transcripts — the same OPSEC failure that has made this entire genre of reporting possible, from the South Korean bank breaches onward.

Not Storm-0940, and that is the point

CrowdStrike stresses that this campaign is separate from the ARTEX activity recently reported under the Storm-0940 designation — the Microsoft-attributed cluster we covered in our Storm-0940 and ConnectWise reporting — and judges it likely that the framework is quickly gaining popularity among multiple China-nexus adversaries. CrowdStrike has previously documented ARTEX and similar agentic frameworks in financially motivated and unattributed hands; a targeted-intrusion actor running parallel multi-target engagements is the escalation step. Since 2021 VAPOR PANDA had primarily targeted government, think tank, energy, and extractive organizations across Europe, North America, Oceania, and the UK for long-term access. The forecast attached is blunt: China-nexus adversaries will highly likely keep adopting agentic frameworks over the next 12 months, paired with commercial LLMs, enabling small teams to scale intrusions across many targets simultaneously.

For defenders, three implications survive contact with skepticism. First, the IOCs CrowdStrike consolidates at the end of its post matter, but the tradecraft matters more: sensor-coverage-aware agents will route around your best-instrumented hosts, so coverage gaps are now actively exploited attack surface rather than passive blind spots. Second, the 200-target figure reframes triage math — campaigns at this breadth mean your organization can be one row in an agent’s task graph without being anyone’s priority target. Third, the open directories keep giving defenders the playbook, but CrowdStrike’s standing judgment from its October report applies unchanged: the version of this tradecraft that stops misconfiguring storage is strictly better, and there is no reason to assume it has not already shipped.

Our write-up is analysis of CrowdStrike’s 29 October 2026 blog post “VAPOR PANDA Uses AI-Driven ARTEX to Grow Global Espionage Campaign” (OverWatch and Counter Adversary Operations, read first-hand in full) for the campaign dates, victim counts, targeting detail, token-consumption figure, transcript excerpts, BLOODALCHEMY mechanics, file names, internal path, Storm-0940 separation, historical targeting, and forward assessment; Unite.AI’s 29 October account (read first-hand) corroborating the 200-organization, 14-country, 11-day, and nine-organization figures. The Microsoft Storm-0940 post is linked through our own prior coverage, not restated — Microsoft’s page returned HTTP 403 to our fetch and is declared unread. All verification was read-only: we accessed no exposed directory, ran no agent framework, resolved no indicator, and contacted no party. Brave Search was used for discovery only.

Sources: