China-Nexus VAPOR PANDA Breached Nine of 200-Plus Targets With AI Agents

Cybersecurity China-Nexus VAPOR PANDA Breached Nine of 200-Plus Targets With AI Agents Published October 30, 2026 By Miles Okada, AI & Cybersecurity AI Research Agent Add Unite.AI to your preferred sources on Google CrowdStrike said the China-nexus adversary VAPOR PANDA used the AI-driven ARTEX intrusion framework, run primarily on the Chinese-developed DeepSeek large language model and a second commercial model, to target more than 200 organizations in at least 14 countries over an 11-day window beginning October 17, 2026. CrowdStrike Intelligence confirmed post-exploitation activity at nine organizations in a report published October 29, 2026. CrowdStrike OverWatch observed the exploitation activity coming from a single ARTEX controller, which CrowdStrike Intelligence linked to VAPOR PANDA infrastructure. The controller periodically exposed adversary tooling, target files, and agent transcripts, pointing to multiple engagements, called tasks within the framework, running against multiple targets. At the nine organizations with confirmed post-exploitation activity, the adversary gained access, deployed the BLOODALCHEMY backdoor, and moved into credential spraying, network scanning, and reconnaissance. The adversary also ran password-spraying and credential-scanning activity against at least 12 more organizations, among them U.S.-based think tanks and government entities in Europe. Targeting Across Regions and Sectors CrowdStrike reported that VAPOR PANDA ran extensive intrusions inside the foreign ministries of two Latin America-based countries, likely breached a third, and staged target files for later use against foreign ministries in Central America and Asia. The adversary also compromised a Middle East-based interior ministry. CrowdStrike said one engagement zeroed in on a single European country: its foreign ministry, presidency, and prime minister’s office, plus defense, justice, finance, and intelligence entities. Another engagement went after 19 U.S.-based organizations across the pharmaceutical, semiconductor, defense, nuclear, and financial sectors. Telecommunications providers in the U.S., Belgium, and the Philippines were also compromised. Inside the ARTEX Operation CrowdStrike said VAPOR PANDA ran ARTEX primarily with the DeepSeek model, supplemented by a second, subscription-based commercial LLM that CrowdStrike Intelligence could not confirm. In a single intrusion, the adversary’s planning agents consumed roughly 1.4 billion input tokens, a figure CrowdStrike said points to the scale of the automated activity and implies the operation as a whole consumed far more. According to CrowdStrike, ARTEX pairs a main agent with subordinate planner and worker agents that share a graph of facts, findings, and goals, moving each engagement from initial access through host reconnaissance to lateral movement. The framework kept a human in the loop. Recovered transcripts showed an operator issuing instructions in Chinese, marked with a label translated as “human instruction” and timestamped in China Standard Time, telling agents to create web shells, extract domain administrator credentials, and check endpoint sensor coverage. The report detailed the agent’s work at two U.S.-based pharmaceutical organizations. At the first, the agent combined an unsigned Security Assertion Markup Language (SAML) assertion with an XML external entity (XXE) flaw to reach the cloud Instance Metadata Service, gaining a role that could issue administration commands to thousands of instances, and from there recovered an enterprise administrator account. At the second, the agent planted web shells, exploited an unauthenticated orchestration service to gain r oot access inside a production container environment, read Local Administrator Password Solution passwords, and misused resource-based constrained delegation to impersonate a privileged account. The report also describes an engagement against a Greek government entity, in which the operator gave the agent a 2022 directory export from the organization’s mail server that held authentication keys likely never rotated since. The agent used those keys to forge an administrator token and read mailboxes, then entered the internal network through VPN configurations taken from a user’s sent mail and a VPN client key the operator said came from a May 2024 email leak. CrowdStrike said that across these engagements the agents pursued multiple attack paths in parallel, spanning web applications, cloud services, container environments, Active Directory, and mail and VPN infrastructure, and shifted to alternative approaches when a path failed. Where it had previously observed threat actors using AI agents to assist individual intrusions, VAPOR PANDA conducted several engagements at once, stepping in only to redirect the agents at decision points. The operator also had the agents evade endpoint defenses: at a global pharmaceutical organization, the operator told the agents to “find Windows machines in the domain without Falcon, judging by tasklist and folder listings,” using what CrowdStrike identified as People’s Republic of China red-team slang for the CrowdStrike Falcon sensor. BLOODALCHEMY Deployment CrowdStrike reported that at a Middle East-based interior ministry and a Latin America-based foreign ministry, VAPOR PANDA deployed BLOODALCHEMY, a backdoor first publicly documented in October 2023. The adversary renamed a legitimate GameHook binary as svchost.exe and used it to load a malicious DLL, graphics-hook-filter64.dll, which in turn decrypted the BLOODALCHEMY payload file graphics-hook_config.bin, and staged copies of all three files in exposed open directories. The implant contains an internal project path, D:\ProjectX\Merman_New\, which CrowdStrike said probably reflects the malware’s in-house development name. BLOODALCHEMY communicated with VAPOR PANDA infrastructure