VAPOR PANDA: CrowdStrike reports a China-nexus actor running the ARTEX agent framework against more than 200 organisations from 17 October, among them foreign ministries in Europe and a Greek government entity, and deploying the BLOODALCHEMY backdoor

CrowdStrike OverWatch reports that from 2026-10-17 a single ARTEX controller linked to VAPOR PANDA infrastructure directed exploitation against entities in at least 14 countries over 11 days, and that the campaign reached more than 200 organisations, including foreign ministries in Europe (CrowdStrike, 2026-10-29). One engagement focused on a single European country, its foreign ministry, presidency, prime minister's office and defence, justice, finance and intelligence entities, and another targeted 19 US organisations in pharmaceuticals, semiconductors, defence, nuclear and finance (CrowdStrike, 2026-10-29). CrowdStrike confirmed post-exploitation at nine organisations and password spraying and credential scanning against at least 12 more, among them government entities in Europe (CrowdStrike, 2026-10-29). CrowdStrike states that the campaign is separate from the Storm-0940 ARTEX activity Microsoft reported and is VAPOR PANDA's first observed use of AI-driven tooling (CrowdStrike, 2026-10-29).

The framework ran mainly on the DeepSeek model, with a human operator steering the agents at decision points while they pursued web, cloud, container, Active Directory, mail and VPN paths in parallel (CrowdStrike, 2026-10-29). In transcripts at a US pharmaceutical company the agent chained an unsigned SAML assertion with an XML external entity flaw to query the cloud instance metadata service and obtain a role that could issue administration commands to thousands of instances; at a second it deployed web shells, abused an unauthenticated orchestration service for root in a container environment, read LAPS passwords and abused resource-based constrained delegation (CrowdStrike, 2026-10-29). Against a Greek government entity the operator supplied a 2022 directory export from the mail server whose authentication keys had likely not been rotated; the agent forged an administrator token, read mailboxes and used VPN configurations from a user's sent mail, with a VPN client key the operator described as coming from a May 2024 email leak, to reach the internal network (CrowdStrike, 2026-10-29). The operator also told the agents to find domain Windows hosts without the CrowdStrike Falcon sensor (CrowdStrike, 2026-10-29). At a Middle East interior ministry and a Latin American foreign ministry the actor loaded the BLOODALCHEMY backdoor through a legitimate GameHook binary renamed svchost.exe that loads a malicious DLL (CrowdStrike, 2026-10-29). No Swiss target is named.