A China-linked hacking group used an artificial intelligence-powered penetration-testing framework to target more than 200 organizations across at least 14 countries in a coordinated cyber espionage campaign, according to a new investigation by CrowdStrike.
The security company identified the group as VAPOR PANDA, which used the ARTEX framework alongside the Chinese-developed DeepSeek large language model to conduct simultaneous intrusions against government agencies, foreign ministries, telecommunications providers and companies in sensitive industries.
The campaign began on October 17, 2026, and continued over an 11-day observation window. However, the more than 200 organizations targeted should not be confused with confirmed breaches. CrowdStrike Intelligence established post-exploitation activity at nine organizations, while at least 12 additional organizations faced password-spraying and credential-scanning attempts.
In its October 29 investigation, CrowdStrike said the attacks originated from a single ARTEX controller that its intelligence team linked to VAPOR PANDA infrastructure. The controller intermittently exposed attacker tools, target files and AI-agent transcripts, providing researchers with evidence of how the operation was coordinated.
Government agencies and sensitive industries targeted
The campaign covered several regions and sectors. VAPOR PANDA conducted extensive intrusions against the foreign ministries of two Latin American countries and likely compromised a third. It also compromised an interior ministry in the Middle East.
In Europe, the attackers targeted multiple government institutions in one country, including its foreign ministry, presidency, prime minister’s office and departments responsible for defence, justice, finance and intelligence.
A separate engagement involved 19 US-based organizations in the pharmaceutical, semiconductor, defence, nuclear and financial sectors. Telecommunications providers in the United States, Belgium and the Philippines were also compromised.
At the nine organizations where CrowdStrike confirmed post-exploitation activity, the attackers gained access, deployed the BLOODALCHEMY backdoor and conducted further credential spraying, network scanning and reconnaissance.
How ARTEX helped coordinate the attacks
ARTEX is an open-source, multi-agent penetration-testing framework designed to automate offensive cybersecurity operations. Rather than relying on a single AI agent, it coordinates a main agent with subordinate planning and worker agents that share information about discovered systems, findings and objectives.
This arrangement allows the framework to divide an attack into smaller tasks, investigate potential access routes and pursue different techniques across targeted environments. Its capabilities include reconnaissance, privilege escalation and lateral movement.
VAPOR PANDA primarily operated ARTEX with DeepSeek, supplementing it with a second subscription-based commercial AI model that CrowdStrike could not identify. In one intrusion, the framework’s planning agents consumed approximately 1.4 billion input tokens, illustrating the scale of automated processing involved in the operation.
Despite the extensive automation, the campaign was not entirely autonomous. Recovered transcripts showed a human operator issuing instructions in Chinese and intervening at decision points to direct the agents.
The instructions included building web shells, extracting domain administrator passwords and checking which computers lacked endpoint security software. At one pharmaceutical organization, the operator specifically directed ARTEX to identify Windows machines without the CrowdStrike Falcon sensor.
According to CrowdStrike, the agents could pursue multiple attack paths simultaneously and switch approaches when an attempt failed. This allowed the operator to oversee several engagements rather than manually execute every stage of each intrusion.
Backdoor deployed in confirmed intrusions
The investigation also identified the deployment of BLOODALCHEMY, a backdoor previously documented in October 2023. VAPOR PANDA used the malware at a Middle Eastern interior ministry and a Latin American foreign ministry.
The attackers disguised a legitimate GameHook executable as the Windows system process svchost.exe to load a malicious DLL named graphics-hook-filter64.dll. The DLL decrypted and loaded the BLOODALCHEMY payload from graphics-hook_config.bin.
CrowdStrike linked the malware’s communications to infrastructure associated with VAPOR PANDA and published indicators of compromise, including command-and-control domains, IP addresses and file hashes, to help security teams investigate potential exposure.
The company described the operation as VAPOR PANDA’s first observed use of AI-driven intrusion tooling. It also distinguished the campaign from separate ARTEX-related activity attributed to another China-nexus threat actor, Storm-0940, which Microsoft previously linked to a compromise involving ConnectWise Cloud Backup.
Discover more from Aree Blog
Subscribe now to keep reading and get access to the full archive.
