CrowdStrike attributes ARTEX campaign against 200+ organizations to VAPOR PANDA

What CrowdStrike says happened

CrowdStrike says VAPOR PANDA used the ARTEX agent framework from October 17, 2026, in a campaign targeting more than 200 organizations across at least 14 countries. The company describes targets including foreign ministries, government entities, pharmaceutical, semiconductor, defense and financial organizations, and telecommunications providers. These figures come from CrowdStrike’s investigation; they are not an independently established count of organizations affected.

The distinction between targets and confirmed intrusions is essential to understanding the campaign’s reported scale. CrowdStrike says it confirmed post-intrusion activity at nine organizations, where it observed deployment of the BLOODALCHEMY backdoor and follow-on actions such as reconnaissance, network scanning and attempts to obtain credentials. It also reports credential-scanning or password-spraying attempts against at least 12 additional organizations. That does not mean every organization targeted was confirmed to have been breached.

ARTEX, the models and the human operator

ARTEX coordinates a main agent with planner and worker agents. According to transcripts analyzed by CrowdStrike, the agents worked with shared information and could advance through different stages of an operation, from initial access to host reconnaissance and exploration of possible movement through a network. The company says the framework was used to run multiple operations in parallel, rather than simply assist with a single intrusion.

CrowdStrike says ARTEX ran primarily with the DeepSeek model, supplemented by a second commercial model available by subscription that the company could not identify. In one intrusion, the planning agents are reported to have consumed on the order of 1.4 billion input tokens. That figure concerns activity observed in a single case; by itself, it does not measure the agents’ effectiveness, the campaign’s overall cost or how much work they completed without human involvement.

The report describes human supervision. Recovered transcripts included an operator’s instructions directing the agents, for example, to write tools, look for administrative credentials or identify which hosts had a security sensor installed. The campaign should therefore not be described as fully autonomous. Automation may have increased scale and allowed tasks to run in parallel, while an operator continued to steer the work.

Nine confirmed cases and the techniques observed

CrowdStrike says it confirmed post-intrusion activity at nine organizations. Actions described include deploying BLOODALCHEMY, searching for credentials and conducting network reconnaissance. Across different cases, the report connects ARTEX use with conventional techniques: exploiting application flaws, using exposed configurations or credentials, and probing cloud services, containers, corporate directories, email and VPNs.

One example in the report combines an unsigned SAML assertion with an XML external entity vulnerability to query a cloud metadata service. CrowdStrike says this sequence enabled the acquisition of credentials for a cloud role and subsequent access to an administrative account. In another case, the company describes the use of authentication keys in an old directory export and a VPN client key that the operator said came from an email leak. The age and origin of those data are presented as part of CrowdStrike’s investigation; they are not independently confirmed here.

The technical significance lies in the combination: ARTEX may have helped coordinate the search for alternative paths when one failed, but the techniques described depended on specific conditions, such as exposed credentials, missing controls or vulnerable systems. The presence of agents does not make an intrusion automatic or inevitable. Nor does the report establish that all targeted organizations were exposed to the same attack paths.

A campaign distinct from the one attributed to Storm-0940

CrowdStrike distinguishes the VAPOR PANDA campaign from other ARTEX activity that the security industry had associated with Storm-0940. The distinction matters: using the same tool does not prove that two operations involved the same group or shared infrastructure, targets or direction.

The company assesses that ARTEX’s use by more than one China-linked actor may indicate that the framework is gaining popularity among such groups. That is CrowdStrike’s assessment, not proof of widespread adoption. The attribution of this campaign to VAPOR PANDA also comes from the company’s investigation; the material available here does not provide independent confirmation from authorities or affected organizations.

CrowdStrike describes the campaign as a geographic and sectoral expansion of VAPOR PANDA’s previously observed activity. It also reports targeting of government entities in several countries and organizations in sectors including telecommunications, defense, finance and pharmaceuticals. The breadth of the reported targets should not be confused with a list of confirmed compromises: the report itself distinguishes activity against more than 200 organizations from post-intrusion activity confirmed at nine.

What organizations can do—and what a search cannot prove

CrowdStrike recommends rotating signing keys, pre-authentication keys and service credentials when exposure is suspected, including those that may appear in backups or historical exports. It also recommends requiring SAML signature validation, requiring IMDSv2 on AWS, limiting cloud roles’ command-execution permissions and keeping internet-facing systems up to date.

The company lists possible ARTEX markers for defensive searches, including “artx” or “artex” strings in command-line parameters, cloud roles prefixed with “artx,” “art18-” comments in administrative commands and the “C:\ProgramData\artx5v\” directory. These are indicators reported in the investigation, not a list guaranteed to detect all ARTEX-related activity. The absence of those markers does not prove that an organization was not targeted.

A proportionate response combines indicator searches with reviews of identity logs, cloud activity, email access and VPN connections. Organizations can prioritize privileged credentials and keys, check whether they remain valid, and review unusual changes or access. These recommendations are defensive measures, not evidence that an organization was attacked or a guarantee that a particular search rules out an intrusion.

What remains unknown

CrowdStrike’s report is a primary source for the observations and assessments the company publishes about this campaign, but the available information does not provide independent confirmation of the attribution, target count or technical details described. Conclusions about VAPOR PANDA and its links to China should be understood as the company’s assessments, not as findings corroborated by multiple independent investigations.

The material also does not establish how many organizations experienced additional impacts beyond the nine with confirmed post-intrusion activity, or the full scope of data accessed or extracted. CrowdStrike reports certain access and activity, but that does not by itself establish the amount of information exfiltrated in each case. Use of a particular model also does not reveal what proportion of the work came from the model, ARTEX’s logic or human instructions.

The token figure, parallel operation and range of techniques describe one campaign as analyzed by CrowdStrike. They are not a general measurement of AI agents’ ability to attack organizations, nor proof that AI makes intrusions successful. The narrower point supported by the report is that CrowdStrike observed ARTEX integrated into operations involving human intervention and established intrusion techniques, and reported nine cases with confirmed post-intrusion activity.

Keep exploring

Corrections and transparency

If you spot incorrect or outdated information, send us a correction with the page and source we should review.