CrowdStrike uncovers China-linked AI cyber campaign

CrowdStrike has uncovered a cyber espionage campaign by China-linked threat actor VAPOR PANDA, which used an agentic artificial intelligence framework to conduct simultaneous intrusions against more than 200 organisations worldwide.

The campaign began on October 17, 2026, and involved ARTEX, an open-source agentic AI framework, alongside the Chinese-developed DeepSeek large language model (LLM) and a second commercial LLM. The operation targeted government institutions, pharmaceutical companies, semiconductor organisations, defence entities and telecommunications providers.

CrowdStrike's OverWatch team observed exploitation activity from a single ARTEX controller directed against organisations in at least 14 countries over an 11-day period. The activity included foreign ministries in Latin America, Europe, Asia and the Middle East, as well as US-based organisations in several strategic industries.

The cybersecurity company confirmed post-exploitation activity at nine organisations, where the attackers gained access, deployed the BLOODALCHEMY backdoor and conducted further credential spraying, network scanning and reconnaissance.

At least 12 additional organisations were subjected to password-spraying and credential-scanning activity, including US think tanks and European government entities.

Broad targeting

VAPOR PANDA conducted extensive intrusions against foreign ministries in two Latin American countries and likely compromised a third. The group also prepared target files for foreign ministries in Central America and Asia.

In the Middle East, the adversary compromised an interior ministry. Another operation focused on a European country, targeting its foreign ministry, presidency and prime minister's office, alongside defence, justice, finance and intelligence entities.

The campaign also involved 19 US-based organisations across the pharmaceutical, semiconductor, defence, nuclear and financial sectors.

Telecommunications providers in the US, Belgium and the Philippines were also compromised.

The targeting represents an expansion of VAPOR PANDA's previous activities. Since 2021, the group has primarily focused on government, think tank, energy and extractive organisations across Europe, North America, Oceania and the UK to establish long-term access.

The latest campaign marks its first observed use of AI-driven intrusion tooling and a broader focus on pharmaceutical, semiconductor, nuclear and defence organisations.

AI operations

VAPOR PANDA primarily operated ARTEX using DeepSeek, supplemented by a second subscription-based commercial LLM that CrowdStrike Intelligence could not identify.

During a single intrusion, the group's planning agents consumed approximately 1.4 billion input tokens. This indicates the scale of automated activity involved in the operation, with total consumption likely substantially higher across the wider campaign.

ARTEX coordinates a main agent with subordinate planning and worker agents. These agents operate through a shared graph of information, findings and objectives, allowing them to progress through different stages of an intrusion, from initial access to host reconnaissance and lateral movement.

However, the framework did not operate entirely independently. Recovered transcripts showed a human operator issuing instructions in Chinese and intervening at key decision points.

The operator directed agents to develop web shells, extract domain administrator passwords and identify endpoint security coverage across targeted environments.

The investigation also found that the agents pursued multiple attack paths simultaneously across web applications, cloud services, container environments, Active Directory, email systems and virtual private network infrastructure.

In one incident involving a US pharmaceutical organisation, an agent exploited an unsigned Security Assertion Markup Language assertion and an XML external entity vulnerability to access cloud instance metadata. This provided credentials associated with a role capable of issuing administrative commands to thousands of instances.

In another pharmaceutical intrusion, the attackers deployed web shells and exploited an unauthenticated orchestration service to obtain root access in a production container environment. They also accessed Local Administrator Password Solution credentials and abused resource-based constrained delegation to impersonate a privileged account.

The campaign also involved attempts to evade endpoint security systems. At a global pharmaceutical organisation, the operator instructed agents to identify Windows machines within the network that did not have CrowdStrike Falcon installed.

This allowed the attackers to concentrate subsequent activity on systems without the endpoint security sensor.

Backdoor deployment

CrowdStrike identified the deployment of BLOODALCHEMY, a backdoor previously documented publicly in October 2023, at a Middle Eastern interior ministry and a Latin American foreign ministry.

The attackers used a legitimate GameHook binary renamed as svchost.exe to load a malicious dynamic-link library. The library, graphics-hook-filter64.dll, decrypted the BLOODALCHEMY payload stored in a file named graphics-hook_config.bin.

Copies of the three files were staged in exposed directories.

The backdoor communicated with infrastructure linked to VAPOR PANDA. CrowdStrike also identified command-and-control infrastructure associated with the malware that had not appeared in previous public reporting about ARTEX.

The findings distinguish this campaign from separate ARTEX activity reported by other industry researchers under the Storm-0940 designation. CrowdStrike said the separate operations suggest the framework is being adopted by multiple China-linked threat actors.

The company assessed that China-linked adversaries are highly likely to continue adopting agentic frameworks such as ARTEX over the next 12 months, combining them with commercially available LLMs to scale intrusions across multiple targets.

CrowdStrike recommended that organisations rotate signing keys, preauthentication keys and service credentials following suspected data exposure, including credentials contained in historical backups and directory exports. It also advised enforcing SAML signature validation, requiring IMDSv2 and restricting cloud roles' command-execution permissions.

The company further recommended patching internet-facing systems and deploying endpoint detection and response agents across organisational environments, including servers that are not directly accessible from the public internet.