A China-linked espionage group used an open-source AI agent framework to probe more than 200 organizations in at least 14 countries in just 11 days, according to new research from CrowdStrike. The group, tracked as Vapor Panda, pointed the framework at foreign ministries, defense contractors, semiconductor firms and telecommunications providers, and it broke into several government networks along the way.
CrowdStrike’s report, published October 29, 2026, is one of the most detailed public looks yet at a state-backed group running intrusions through autonomous AI agents. It is the first time CrowdStrike has seen Vapor Panda use AI tooling.
One controller, more than 200 targets
CrowdStrike’s OverWatch threat hunting team said the campaign began on October 17, 2026. A single controller running ARTEX, a Chinese-developed agentic penetration testing framework that is freely available on GitHub, drove operations against more than 200 organizations over the following 11 days.
The targets fit a classic espionage profile:
- Foreign ministries in Latin America, Europe, Asia and the Middle East
- U.S. semiconductor companies, defense contractors and think tanks
- Telecommunications providers in the United States, Belgium and the Philippines
- 19 U.S. organizations across the pharmaceutical, semiconductor, defense, nuclear and financial sectors
CrowdStrike said the group gained access to the networks of 2 Latin American foreign ministries and likely a third, and compromised an interior ministry in the Middle East. In one European country, the operation reached the foreign ministry, the presidency, the prime minister’s office and the defense, justice, finance and intelligence agencies. CrowdStrike confirmed post-exploitation activity at 9 organizations and password spraying against at least 12 more. The researchers did not name any of the victims.
How ARTEX runs an intrusion
ARTEX is written in Go with a Next.js front end. It splits work among a main agent, a planner agent and worker agents that share a common graph of everything they have learned about a target. An operator types high-level goals, and the agents break them into tasks, run tools and report back.
Vapor Panda primarily ran ARTEX on DeepSeek models, CrowdStrike said, along with a second commercial model it could not confirm. The scale of the AI usage stands out. In one intrusion alone, the agents consumed about 1.4 billion input tokens.
Human operators were still steering. Recovered transcripts showed an operator issuing instructions in Chinese, marked with the label “human instruction” and timestamped in China Standard Time. The operator told the agents to write web shells, extract domain administrator passwords and take stock of endpoint sensor coverage. At one pharmaceutical company, the agents were told to find Windows machines in the domain that were not running CrowdStrike’s Falcon sensor, so follow-on activity could focus on unprotected hosts.
Attack chains built from old mistakes
The intrusions CrowdStrike described did not rely on new zero-days. Instead, the agents chained together known weaknesses and long-forgotten secrets, often moving faster than a human team would.
In one case, the agents combined an unsigned SAML assertion flaw with an XML external entity (XXE) bug to read cloud instance metadata. That gave them a cloud role able to send commands to thousands of instances, which they turned into enterprise administrator access. Elsewhere, they used web shells, an unauthenticated orchestration service that granted root inside containers, reads of Local Administrator Password Solution (LAPS) passwords and abuse of resource-based constrained delegation in Active Directory.
The most striking chain hit a Greek government entity. According to CrowdStrike, the operator handed the agent a 2022 directory export from the organization’s mail server that contained authentication keys likely never rotated since. The agent used those keys to forge an administrator token and read mailboxes. It then combined VPN configuration files recovered from a user’s sent mail with a VPN client key that the operator described as coming from a May 2024 email leak to reach the internal network. Each piece was old, but together they opened the door.
That pattern is likely to matter to defenders more than the AI angle itself. Old backups, leaked mailboxes and unrotated keys were what made the attacks work. The agents simply found and combined them quickly.
BLOODALCHEMY backdoor and infrastructure
At the Middle East interior ministry and a Latin American foreign ministry, Vapor Panda deployed BLOODALCHEMY, a backdoor first publicly documented by Elastic Security Labs in October 2023. CrowdStrike said the group loaded it through DLL side-loading: a renamed GameHook binary disguised as svchost.exe loaded a malicious graphics-hook-filter64.dll, which decrypted the backdoor from a configuration file named graphics-hook_config.bin.
CrowdStrike published the following command-and-control domains:
nginxmysql[.]comsqlserver-sqlite[.]comwww[.]ddduuuppp[.]com
Since 2021, Vapor Panda has mainly targeted government, think tank, energy and extractive organizations in Europe, North America, Oceania and the UK in pursuit of long-term access. CrowdStrike said this campaign marks a notable expansion into the pharmaceutical, semiconductor, nuclear and defense sectors and into foreign ministries in new regions.
ARTEX is spreading among threat actors
Vapor Panda is not the only group using ARTEX. Earlier this month, CrowdStrike reported that an unattributed, likely financially motivated actor used the framework against South Korean financial organizations from late September into early October, alongside DeepSeek and other large language models.
Microsoft has also tied ARTEX to Storm-0940, a China-state aligned actor it says has used the framework since September 2026. In an October 21 report, Microsoft said Storm-0940 was behind the ConnectWise supply chain compromise that reached Microsoft 365 customers, reached privileged access in some environments in under 3 hours and made more than 151,000 failed logon attempts during a password spraying burst between October 10 and 14. CrowdStrike said its Vapor Panda findings are separate from the Storm-0940 activity, which it believes shows the framework is quickly gaining popularity among multiple China-linked groups.
The research adds to a busy month of reporting on Chinese state-backed operations, including Volt Typhoon’s Silent Train campaign and Warp Panda’s VMware ESXi zero-day attacks on law firms. It also follows growing evidence that AI models can carry out real intrusions, such as the case of OpenAI models that escaped a cyber test and compromised Hugging Face.
Why it matters
Security teams have long assumed that a broad, persistent campaign against hundreds of targets requires a large, skilled human team. ARTEX changes that math. A small group of operators can hand off reconnaissance, credential hunting and lateral movement to agents that work through targets in parallel and never get tired.
The good news is that the agents still depend on the same weaknesses human attackers do. Organizations that keep secrets out of old exports, rotate keys and close off cloud metadata abuse make the agents’ job much harder.
What defenders should do
CrowdStrike’s recommendations focus on the weaknesses the agents exploited and on finding ARTEX activity:
- Rotate signing keys, including any that may survive in historical backups or directory exports
- Enforce SAML signature validation on identity providers and service providers
- Require IMDSv2 on cloud instances and restrict what instance roles are allowed to do
- Patch internet-facing appliances, particularly long-lived Linux servers, and keep their software and firmware current
- Run endpoint detection and response coverage across the environment, including on servers believed to be unreachable from the internet
- Hunt for ARTEX artifacts, including
artxorartexstrings, cloud roles with anartxprefix,art18-comments and the directoryC:\ProgramData\artx5v\ - Block the BLOODALCHEMY domains listed above and look for
graphics-hook-filter64.dllloaded by a binary posing assvchost.exe
China’s government has not publicly responded to CrowdStrike’s findings. None of the targeted governments had issued any public statement at time of publication.
