# VAPOR PANDA: one ARTEX controller ran an 11-day espionage campaign

> VAPOR PANDA ran a global espionage campaign through ARTEX, an agentic framework that planned intrusions with light human steering.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Incident, Attack
- **Published by:** CrowdStrike
- **Disclosed:** 2026-10-29
- **Affects:** ARTEX, DeepSeek
- **Research by:** Counter Adversary Operations
- **Primary source:** https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/
- **Page:** https://theinjection.dev/items/crowdstrike-vapor-panda-artex/

VAPOR PANDA, a China-linked espionage actor, used the agentic ARTEX framework against more than 200 organizations in at least 14 countries in an 11-day window, CrowdStrike reports. Post-exploitation was confirmed at nine of them.

## What happened

CrowdStrike's Counter Adversary Operations team published its analysis of VAPOR PANDA on October 29, 2026. The China-linked actor began the campaign on October 17, 2026 and reached entities in at least 14 countries from a single ARTEX controller. CrowdStrike says this activity is separate from the ARTEX campaigns that industry reports track under the Storm-0940 designation.

## How it works

ARTEX pairs a main agent with planner and worker agents that share a graph of facts, findings and goals. The agents pursued several routes at once across web applications, cloud accounts, containers, Active Directory and mail and VPN infrastructure, and changed route when one failed. A Chinese-speaking operator stepped in at decision points, for example to order web shell writes or the extraction of domain administrator passwords. CrowdStrike says the planning agents consumed on the order of 1.4 billion input tokens in one intrusion.

## Who is affected

Targets named by CrowdStrike include foreign ministries in Latin America, Europe, Asia and the Middle East, a European presidency and prime minister's office, and telecommunications providers in the United States, Belgium and the Philippines. One engagement targeted 19 United States organizations across semiconductors, defense, pharmaceuticals, nuclear, think tanks and finance.

## What to do

Hunt for the ARTEX markers CrowdStrike lists: command lines containing artx or artex, cloud roles with an artx prefix, administration-command comments beginning art18-, and the C:\ProgramData\artx5v\ directory. Rotate signing keys, preauthentication keys and service credentials after suspected exposure, including copies held in backups and directory exports. Extend EDR coverage to servers that are not reachable from the internet, because at one pharmaceutical target the operator told the agents to look for hosts without a sensor.

## Quick facts

- **Actor:** VAPOR PANDA, China-linked, per CrowdStrike
- **Framework:** ARTEX: a main agent directing planner and worker agents
- **Models:** DeepSeek, plus a second commercial model CrowdStrike could not confirm
- **Window:** 11 days, from October 17, 2026
- **Reach:** More than 200 organizations in at least 14 countries
- **Confirmed intrusions:** Nine organizations, with 12 more hit by password spraying and credential scanning
- **Malware:** BLOODALCHEMY, loaded by a renamed GameHook binary

## Sources

1. [CrowdStrike Report](https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/)
2. [Earlier ARTEX Campaigns](https://www.crowdstrike.com/en-us/blog/crowdstrike-uncovers-new-agentic-ai-campaigns/)