VAPOR PANDA and ARTEX: How One AI Agent Controller Targeted 200+ Organizations in 11 Days

CrowdStrike says a China-nexus group ran an AI agent framework against more than 200 organizations in 11 days, and confirmed breaches at nine. In a report published October 29, 2026, CrowdStrike OverWatch attributes the campaign to VAPOR PANDA, which used the ARTEX framework with the DeepSeek model and a second commercial model to run intrusions in parallel. NBC News carried the headline number. The number to keep in mind is nine, not 200: the larger figure counts targets.

This is an attacker-side agent story. It does not involve a flaw in a coding agent, and most readers are not the victims. It matters because it shows the planner-and-worker pattern that coding agents use today, run with an adversary's goals, and because CrowdStrike published concrete markers you can hunt for.

What CrowdStrike reports

CrowdStrike OverWatch says that beginning October 17, 2026 it saw exploitation activity from a single ARTEX controller directed at entities in at least 14 countries over an 11-day window. The controller intermittently exposed adversary tooling, target files and agent transcripts, which is how CrowdStrike could reconstruct the work. Those artifacts show multiple engagements, which ARTEX calls "tasks", against multiple targets.

Reported targets include foreign ministries in Latin America, Europe, Asia and the Middle East; semiconductor, defense and think tank organizations in the United States; and telecommunications providers in several regions. One engagement went after a single European country's foreign ministry, presidency, prime minister's office and defense, justice, finance and intelligence entities. Another targeted 19 U.S. organizations in pharmaceutical, semiconductor, defense, nuclear and financial sectors.

Claimed versus confirmed

The wire headline says "200 organizations in 11 days". CrowdStrike's own wording is more careful, and the gap is the useful part.

Press summaries add derived numbers, such as targets per day, that CrowdStrike did not state. Treat those as arithmetic.

How the agent framework worked

CrowdStrike describes ARTEX as a main agent coordinating subordinate planner and worker agents over a shared graph of facts, findings and goals, advancing each engagement from initial access through host reconnaissance and lateral movement. That is the same shape as a coding-agent harness: a planner decomposes, workers run tools, and results go back into shared context.

A human stayed in the loop. Recovered transcripts show an operator issuing instructions in Chinese, labeled 【人类指令】 ("human instruction") and timestamped in China Standard Time, directing the agents to write web shells, extract domain administrator passwords and inventory endpoint sensor coverage. CrowdStrike's point is the parallelism: earlier actors used agents to assist a single intrusion, while VAPOR PANDA ran many at once and intervened only to steer.

On scale, CrowdStrike says planning agents in a single intrusion consumed on the order of 1.4 billion input tokens, implying far more across the operation. Model cost is evidently not what limits this kind of campaign.

Attack chains from the transcripts

CrowdStrike summarizes several intrusions. None needs a novel exploit:

1. Pharmaceutical organization, cloud path. The agent chained an unsigned SAML assertion and an XML external entity (XXE) flaw to query the cloud instance metadata service, obtained a role able to issue administration commands to thousands of instances, then escalated to an enterprise administrator account.
2. Second pharmaceutical organization. The agent deployed web shells, abused an unauthenticated orchestration service to get root in a production container environment, read LAPS passwords and abused resource-based constrained delegation to impersonate a privileged account.
3. Greek government entity. The operator supplied a 2022 directory export from the mail server containing authentication keys that had likely never been rotated. The agent forged an administrator token, read mailboxes, and used VPN configurations from a user's sent mail and a VPN client key from a May 2024 email leak to reach the internal network.
4. Defense evasion. At a global pharmaceutical organization the operator told the agents to find Windows machines in the domain without the Falcon sensor by reading tasklists and folder listings. Building sensor-coverage checks into the workflow lets the group concentrate on unprotected hosts.

The third case is the instructive one: an old leak plus a key nobody rotated, now cheap to exploit because an agent does the stitching.

Why this campaign differs from earlier ARTEX reports

CrowdStrike frames the novelty in three parts. First, scale: one controller and a small team pursuing a target list that manual operations could not support. Second, breadth: VAPOR PANDA's historic focus on government, think tank, energy and extractive targets widened into pharmaceutical, semiconductor, nuclear and defense sectors and into new regions. Third, resilience: running DeepSeek alongside a second commercial model through a purpose-built harness likely reflects a deliberate choice not to depend on any single model provider.

CrowdStrike is equally clear about what did not change. It describes the work as a broadening of an established access-development mission, not a wholesale shift away from it, and it notes that the agents paired an AI-driven workflow with well-established tradecraft: web shells, password spraying, credential theft, delegation abuse and a known backdoor. For defenders that is mildly reassuring. Detection that already catches those techniques still applies; what shrinks is the time you have to respond once an agent is running them against many networks at the same moment.

It also adds telemetry that earlier public ARTEX reports lacked. CrowdStrike says Falcon data revealed the BLOODALCHEMY deployment and its command-and-control infrastructure, neither of which appeared in prior reporting, which is why this write-up is worth reading in full if you maintain detections.

BLOODALCHEMY and indicators

At a Middle East interior ministry and a Latin American foreign ministry, the group deployed BLOODALCHEMY, a backdoor that Elastic documented in October 2023. It used a legitimate GameHook binary renamed svchost.exe to side-load graphics-hook-filter64.dll, which decrypts the payload file graphics-hook_config.bin. CrowdStrike lists these C2 domains, defanged in its report: nginxmysql[.]com, sqlserver-sqlite[.]com and www[.]ddduuuppp[.]com, plus SHA-256 hashes for the loader and payload. Take the full list from the CrowdStrike post rather than from here.

Timeline

• 2021: VAPOR PANDA first active, per CrowdStrike, mostly against government, think tank, energy and extractive targets.
• Late September to early October 2026: ARTEX appears in the South Korean bank intrusions.
• October 8: the ARTEX developer makes the project closed-source, per Wiz, as covered in our Storm-0940 post.
• October 17: VAPOR PANDA's ARTEX controller begins its 11-day run.
• October 21: Microsoft reports Storm-0940's use of ARTEX.
• October 29: CrowdStrike publishes the VAPOR PANDA report.

CrowdStrike expects China-nexus adversaries to "highly likely" keep adopting agentic frameworks like ARTEX over the next 12 months, paired with commercial LLMs. Other ARTEX-related coverage on Beam includes the 123 Reg claim, Wiz's agentic fingerprints and Unit 42's cybercrime findings. See the October 2026 attacks timeline for the wider picture.

What this means if you run AI coding agents

Your laptop is probably not the target, but the lessons transfer:

1. Hunt for ARTEX markers if you run a security team: command lines containing artx or artex, artx-prefixed cloud roles, art18- comments on administration commands, and the directory C:\ProgramData\artx5v\.
2. Rotate old keys. The Greek case used keys from a 2022 export. Search for exported directories, mail-server key material and VPN configs sitting in mailboxes.
3. Check instance metadata exposure. Require IMDSv2-style session tokens where your cloud supports them, and look at what roles an XXE-reachable service can obtain.
4. Verify sensor coverage. The operator's explicit goal was finding hosts without endpoint protection. Know which of your Windows machines lack a sensor before an agent does.
5. Expect speed. Attacks like this compress days of reconnaissance into minutes. Alert on credential spraying and unusual administrative commands, and shorten the time to rotate.
6. Inventory what your own agents can reach. A coding agent holding cloud credentials has the same planner-plus-tools shape. Review which keys sit in .env files and shell profiles; see API keys in logs and env vars.

What Beam can and cannot do here

Beam does not apply to the intrusions CrowdStrike describes. It watches what coding agents such as Claude Code and Codex do on your machine, flags credential exposure and risky commands, scans skills and MCP configs, and keeps data on-device. It cannot see ministry networks, cloud metadata services or SAML flaws, and it is not an EDR. Its relevance is narrower: if an agent on a developer machine reads cloud credentials or old key exports, Beam's flags help you notice, and in workspaces with policy enforcement it can deny some actions via Claude Code and Codex PreToolUse hooks. That deny is hook-based, not a sandbox, and fails open when no cached policy is available. See how it works and what it watches.

Frequently asked questions

What did CrowdStrike say VAPOR PANDA did?

CrowdStrike OverWatch says that from October 17, 2026 VAPOR PANDA used the ARTEX agent framework against more than 200 distinct organizations in at least 14 countries over 11 days, running several intrusions in parallel. CrowdStrike Intelligence confirmed post-exploitation activity at nine organizations.

Were 200 organizations breached?

No. The 200+ figure counts organizations targeted. CrowdStrike confirmed that the adversary gained access, deployed the BLOODALCHEMY backdoor and carried out follow-on activity at nine, and saw password spraying or credential scanning at at least 12 more. Some press headlines blur targeting and compromise.

Which AI models did ARTEX use?

CrowdStrike says the group ran ARTEX primarily with the Chinese-origin DeepSeek model, supplemented by a second subscription-based commercial LLM that it could not confirm. In one intrusion, planning agents consumed on the order of 1.4 billion input tokens.

Is this the same campaign as Storm-0940?

No. CrowdStrike states the VAPOR PANDA campaign is separate from the ARTEX activity Microsoft reported under the Storm-0940 name. It suggests multiple China-nexus adversaries are adopting the framework.

How can I hunt for ARTEX activity?

CrowdStrike recommends hunting for command-line parameters containing artx or artex, artx-prefixed cloud roles, art18- administration-command comments and the C:\ProgramData\artx5v\ directory, plus the BLOODALCHEMY loader and C2 indicators listed in its report.

Does this affect people who run coding agents?

Not directly; the targets were ministries, defense, pharma and telecom networks. It matters because it shows attackers using the same agent pattern you use, with planning and worker agents, which shortens the window between exposure and compromise.

Related reading

• Storm-0940 and ARTEX: AI agents and a ConnectWise credential
• South Korea bank hack: ARTEX and Claude Code sessions
• Wiz: seven fingerprints of agentic attacks
• Anatomy of an AI-driven cloud attack
• October 2026 attacks timeline

Sources: CrowdStrike: VAPOR PANDA Uses AI-Driven ARTEX · NBC News · Microsoft Threat Intelligence · Elastic Security Labs

Accurate as of October 30, 2026, based on CrowdStrike's October 29 report. Attribution is the vendor's assessment and counts may change. Beam is a local prototype; features described are as documented at the time of writing.