What did CrowdStrike find?
CrowdStrike published the research on October 29, 2026. It describes a campaign by VAPOR PANDA, a group the company calls China-nexus and says it has tracked since 2021. The group used ARTEX, an open-source agentic AI framework, against more than 200 organizations.
The activity began on October 17 and ran for 11 days. CrowdStrike says a single ARTEX controller directed attacks against entities in at least 14 countries. The controller intermittently exposed target files, tooling and agent transcripts, which gave researchers a detailed view of the workflow.
CrowdStrike confirmed post-exploitation at nine organizations. There, the intruders gained access, deployed the BLOODALCHEMY backdoor, and ran credential spraying, network scanning and reconnaissance. At least 12 more organizations were sprayed or scanned.
NBC News reported the finding on the same day. It said Chinese state-linked hackers used AI, including DeepSeek, against more than 200 organizations in 11 days. The article stressed the scale that AI makes possible.
The 200-plus figure describes targets, not confirmed breaches. CrowdStrike confirmed access at nine. For other targets, the report describes staging, scanning and attempts rather than successful intrusion. That difference matters for anyone assessing the damage, and it is the first number to check in coverage of the report.
The report follows two earlier disclosures. CrowdStrike documented ARTEX use in attacks on South Korean financial institutions on October 7. Microsoft described Storm-0940's use of the framework on October 21. The new blog says VAPOR PANDA's campaign is separate from the Storm-0940 activity, which makes ARTEX look like shared tooling rather than one group's private kit.
What is ARTEX, and who built it?
ARTEX is an open-source framework for automated penetration testing. It was developed in China and first unveiled in July 2026, according to Korea JoongAng Daily. Security teams can use it to test their own networks for weaknesses.
Microsoft analysed the framework in an October 21 report. It described ARTEX as a multi-agent LLM system written in Go with a Next.js frontend. The interface defaults to English and can switch to Korean, Mandarin, Spanish or Japanese.
The framework can use any AI model. Its agents run a penetration test from reconnaissance through data exfiltration with little human input. They collect discovered assets and vulnerabilities into a graph as they work.
CrowdStrike describes a similar structure. A main agent coordinates planner and worker agents over a shared graph of facts, findings and goals. That design lets one operator manage several engagements at once.
ARTEX has a legitimate use, and its developer has condemned the attacks. The developer, who uses the handle Autumn-27 on GitHub, announced on October 8 that the project would go closed-source. The post cited “misuse of the tool,” according to Korea JoongAng Daily.
Closing the repository does not recall copies. Anyone who downloaded the code can keep running it, as the same report noted. Researchers therefore expect the tool to remain in use despite the developer's decision.
Microsoft says it has seen threat actors in multiple regions using ARTEX, not just one group. That fits CrowdStrike's account of at least three separate actors using the framework within weeks. Because the code is open source and model-agnostic, blocking one model provider or one range of infrastructure does not remove the tool itself.
How did the AI agents run so many intrusions at once?
The operation was not fully autonomous. CrowdStrike recovered transcripts showing a human operator issuing instructions in Chinese. The prompts carried the label 【人类指令】, meaning “human instruction,” and timestamps in China Standard Time.
The operator steered the agents at decision points. It told them to write web shells, extract domain administrator passwords and inventory endpoint coverage. The agents handled the repetitive work between those interventions.
Agents pursued several attack paths in parallel. CrowdStrike lists web applications, cloud services, container environments, Active Directory, mail and VPN infrastructure. When one path failed, the agents moved to another.
The scale shows in token use. In one intrusion, planning agents consumed about 1.4 billion input tokens, CrowdStrike says. That figure covers a single engagement, so total consumption across the campaign was likely much higher.
VAPOR PANDA ran ARTEX mainly with DeepSeek, a Chinese model. It added a second, subscription-based commercial model that CrowdStrike could not identify. The mix suggests a deliberate effort to avoid depending on one provider.
Individual intrusions were specific. At one US pharmaceutical company, an agent chained an unsigned SAML assertion with an XML external entity flaw. It reached cloud instance metadata and obtained a role that could send commands to thousands of instances.
At a second US pharmaceutical company, agents deployed web shells and abused an unauthenticated orchestration service. They gained root in a production container, read LAPS passwords and abused resource-based constrained delegation to impersonate a privileged account.
At a Greek government entity, the operator supplied a 2022 directory export from a mail server. The agent used authentication keys in it to forge an administrator token, read mailboxes and reach the internal network through VPN details found in email. CrowdStrike says the keys had likely not been rotated since the export.
The backdoor chain was the same at two victims. VAPOR PANDA used a legitimate GameHook binary renamed svchost.exe to load a malicious DLL called graphics-hook-filter64.dll. That DLL decrypted a BLOODALCHEMY payload stored as graphics-hook_config.bin. CrowdStrike found copies of all three files in exposed directories, and the implant carried an internal path, D:\ProjectX\Merman_New\, that likely reflects its in-house name.
ARTEX calls each engagement a task. CrowdStrike says the exposed controller showed evidence of multiple tasks against multiple targets, each with its own transcripts. That structure is what made a parallel campaign visible to researchers rather than a blur of unrelated alerts.
Which governments and companies were targeted?
The target list is broad and unusually senior. CrowdStrike says the campaign reached foreign ministries in Latin America, Europe, Asia and the Middle East. It conducted extensive intrusions at two Latin American foreign ministries and likely compromised a third.
The group also staged target files for foreign ministries in Central America and Asia. It compromised an interior ministry in the Middle East. One engagement focused on a single European country, hitting its foreign ministry, presidency and prime minister's office.
That European engagement also covered defense, justice, finance and intelligence entities. A separate engagement targeted 19 US-based organizations in pharmaceuticals, semiconductors, defense, nuclear and finance.
Telecommunications providers in the US, Belgium and the Philippines were compromised. Password spraying and credential scanning also hit at least 12 additional organizations, including US think tanks and European government entities.
The spread marks a change. Since 2021, VAPOR PANDA focused on government, think tank, energy and extractive organizations in Europe, North America, Oceania and the UK. This is its first observed use of AI-driven intrusion tooling, and it widens the group's target set.
The mix is notable. Foreign and interior ministries hold diplomatic and domestic security files. Semiconductor, nuclear and defense firms hold sensitive technology. Telecom operators run infrastructure that other organizations depend on. A single framework reaching all three groups in 11 days is the practical meaning of scale in this report.
Some targets were staged rather than reached. CrowdStrike says the group prepared target files for foreign ministries in Central America and Asia. That points to planning beyond the confirmed victims, even where researchers saw no post-exploitation activity.
How is this different from Storm-0940 and the Korean bank hacks?
CrowdStrike says the VAPOR PANDA campaign is separate from activity that industry reports call Storm-0940. Microsoft attributed that campaign to a different China-state-aligned actor and published its analysis on October 21.
Microsoft said Storm-0940 used ARTEX from as early as September 2026 against hundreds of organizations worldwide. In some cases, the time from initial targeting to privileged cloud access was under three hours.
Microsoft tied Storm-0940 to the ConnectWise Cloud Backup supply chain compromise. Between October 10 and 14, its infrastructure sprayed 327 accounts across eight organizations. Telemetry recorded more than 151,000 failed logon events.
Microsoft cautioned that an affected application, or a successful sign-in, does not prove that data was taken. It said it identified authentication and follow-on activity in multiple customer environments. That distinction keeps the confirmed damage narrower than the target list.
That spray peaked at 2,900 failures per minute on October 11. More than 111,000 failures fell on a single day, and 48 accounts received over 1,000 attempts each. Microsoft says it saw no successful authentication in that particular spray.
The Korean case is a third strand. Between late September and early October, at least nine South Korean financial institutions were breached or targeted, according to Reuters reporting cited by Korea JoongAng Daily. CrowdStrike linked that activity to ARTEX as well.
The Korean actor was not attributed to a state. CrowdStrike assessed with moderate confidence that the actor was a Chinese speaker and financially motivated. Its reported models included DeepSeek v4.1-flash, GLM-5.3 and Grok 4.6, alongside Claude Code.
Three different actors, one tool. That is the common thread, and it suggests ARTEX has spread quickly among groups with different goals.
The shared tool complicates attribution for defenders. A detection that names ARTEX points to a framework, not a group. Analysts still need infrastructure, malware and targeting data to separate a financially motivated intruder from an espionage unit. That work is slower than the intrusions it is meant to explain.
Why does speed matter for defenders?
Agentic tools compress the time between detection and damage. Microsoft reported cases where privileged access arrived in under three hours. Humans reviewing alerts rarely respond that fast, especially when many alerts arrive at once.
The volume is also a problem. Automated probing creates large amounts of traffic and log data. It can generate alerts, but the pace leaves little time to triage them and remove access.
The agents were also told to avoid monitored hosts. At a global pharmaceutical company, the operator asked for Windows machines without Falcon, CrowdStrike's endpoint sensor. The English translation reads: “find Windows machines in the domain without Falcon, judging by tasklist and folder listings.”
The Chinese term used was 狩鹰, or falcon, which CrowdStrike describes as red-team slang for its product. Building that check into an agent workflow lets an intruder focus on unprotected systems.
Both vendors published defensive steps. Microsoft recommends reviewing service principal sign-ins and unexpected application credential changes. It also recommends following ConnectWise's containment guidance and preserving evidence.
CrowdStrike recommends rotating signing keys and service credentials after any suspected exposure. It also advises enforcing SAML signature validation, requiring IMDSv2 and limiting cloud roles that can issue commands.
Its hunting guidance lists ARTEX markers, including command lines containing artx or artex, artx-prefixed cloud roles and the directory C:\ProgramData\artx5v\. Patching internet-facing appliances and covering servers with EDR also appear on the list.
Microsoft's queries focus on identity paths. They check whether ConnectWise applications are present, whether their service principals signed in, and what Graph activity followed. That approach reflects the campaign's method: stolen application credentials can authenticate without an interactive user sign-in.
What are the limits, and what happens next?
The report rests on CrowdStrike's own telemetry and on exposed directories it found. The victims are not named, and CrowdStrike has not published an independent forensic review. Readers cannot cross-check the findings against a victim's own account.
Some details remain uncertain. CrowdStrike could not identify the second commercial model. It links the controller to VAPOR PANDA infrastructure, but the public blog does not state a confidence level for that attribution.
Beijing has distanced itself from the related Korean intrusions. A Chinese foreign ministry spokesperson said she was unfamiliar with the case and that China opposes hacking, Korea JoongAng Daily reported. That statement did not address the VAPOR PANDA campaign.
ARTEX itself is dual-use. It was built for security testing, and its developer shut down public releases after the Korean attacks. The tool's earlier code remains available, and the developer cannot control how copies are used.
CrowdStrike expects more of this. It says China-nexus adversaries will highly likely keep adopting agentic frameworks over the next 12 months. The forecast is an assessment, not an observed fact.
CrowdStrike has not named the affected organizations, so their side of the story is missing. That gap is normal during incident response, but it limits what outsiders can verify. The clearest near-term test will be whether governments in the 14 countries issue advisories or attribute the campaign themselves.
The 11-day window also limits comparisons with long-running espionage. A short burst of parallel attacks says little about how long an intruder could stay hidden after access. CrowdStrike describes confirmed post-exploitation, not the full lifetime of any intrusion.
The next signals to watch are government advisories, disclosures from victims in the 14 countries, and any expansion of the ConnectWise fallout. Enterprises should also check whether third-party applications hold more access than they need.