VAPOR PANDA (China-nexus) used ARTEX AI agents running DeepSeek to target 200+ organizations in 11 days, compromising at least nine (no CVE)
Severity: high · Patch status: no-fix-needed · Since 2026-10-29
CrowdStrike reported on Oct 29, 2026 that VAPOR PANDA, a China-nexus espionage group active since 2021, ran the ARTEX agentic AI pentest framework against more than 200 organizations in at least 14 countries during an 11-day campaign that began Oct 17, 2026. The ARTEX agents ran mainly on the Chinese DeepSeek LLM, with a second subscription-based commercial model that CrowdStrike could not confirm. CrowdStrike OverWatch confirmed post-exploitation activity at nine organizations. They include two Latin American foreign ministries, with a third likely compromised, a Middle East interior ministry, a Greek government entity, telecoms in the US, Belgium and the Philippines, and two US pharmaceutical companies. At least 12 more organizations faced password spraying or credential scanning. The targets also included semiconductor, defense, nuclear, financial and think-tank organizations. Initial access came from several routes: an unsigned SAML assertion combined with an XXE flaw, which was then used to query the cloud metadata service for a role that could run commands on thousands of instances; web shells plus an unauthenticated orchestration service, which gave root in a production container environment; a 2022 directory export with unrotated keys, used to forge an admin token; VPN configs and a client key recovered from old mail leaks; and password spraying. Follow-on steps included LAPS password reads, resource-based constrained delegation abuse, mailbox access, JSP/PHP web shells, and the BLOODALCHEMY backdoor at two ministries. A human operator steered the agents in Chinese and had them look for Windows hosts without an EDR sensor. One intrusion's planning agents consumed about 1.4 billion input tokens. No CVE or product patch is named; the fixes are key rotation, SAML and IMDS hardening, and EDR coverage. CrowdStrike says this activity is separate from the ARTEX use Microsoft attributes to Storm-0940 in the ConnectWise Cloud Backup compromise, which suggests that several China-nexus actors have adopted the framework.
What to do
- Rotate signing keys, Kerberos preauthentication keys and service credentials after any suspected exposure, including keys that sit in backups and old directory exports
- Enforce SAML signature validation on every service provider and reject unsigned assertions
- Require IMDSv2 on cloud instances and restrict which roles may send commands to instances (for example SSM Run Command)
- Hunt for ARTEX markers: command lines containing 'artx' or 'artex', cloud roles with an 'artx' prefix, 'art18-' comments, and C:\ProgramData\artx5v\
- Block or hunt the C2 domains published by CrowdStrike (nginxmysql[.]com, sqlserver-sqlite[.]com, www[.]ddduuuppp[.]com) and look for Chisel, SoftEther and Tor tunnels
- Deploy EDR to every host, internal-only servers included; the operator specifically searched for Windows machines without a sensor
- Patch internet-facing appliances and long-lived Linux servers, and review VPN configs or keys that have leaked by email
Sources
All live incidents on Threat Watch
