VAPOR PANDA: one ARTEX controller ran an 11-day espionage campaign
VAPOR PANDA ran a global espionage campaign through ARTEX, an agentic framework that planned intrusions with light human steering.
· CrowdStrike · Research by Counter Adversary Operations
VAPOR PANDA, a China-linked espionage actor, used the agentic ARTEX framework against more than 200 organizations in at least 14 countries in an 11-day window, CrowdStrike reports. Post-exploitation was confirmed at nine of them.
01What happened
CrowdStrike's Counter Adversary Operations team published its analysis of VAPOR PANDA on October 29, 2026. The China-linked actor began the campaign on October 17, 2026 and reached entities in at least 14 countries from a single ARTEX controller. CrowdStrike says this activity is separate from the ARTEX campaigns that industry reports track under the Storm-0940 designation.
02How it works
ARTEX pairs a main agent with planner and worker agents that share a graph of facts, findings and goals. The agents pursued several routes at once across web applications, cloud accounts, containers, Active Directory and mail and VPN infrastructure, and changed route when one failed. A Chinese-speaking operator stepped in at decision points, for example to order web shell writes or the extraction of domain administrator passwords. CrowdStrike says the planning agents consumed on the order of 1.4 billion input tokens in one intrusion.
03Who is affected
Targets named by CrowdStrike include foreign ministries in Latin America, Europe, Asia and the Middle East, a European presidency and prime minister's office, and telecommunications providers in the United States, Belgium and the Philippines. One engagement targeted 19 United States organizations across semiconductors, defense, pharmaceuticals, nuclear, think tanks and finance.
04What to do
Hunt for the ARTEX markers CrowdStrike lists: command lines containing artx or artex, cloud roles with an artx prefix, administration-command comments beginning art18-, and the C:\ProgramData\artx5v\ directory. Rotate signing keys, preauthentication keys and service credentials after suspected exposure, including copies held in backups and directory exports. Extend EDR coverage to servers that are not reachable from the internet, because at one pharmaceutical target the operator told the agents to look for hosts without a sensor.
Sources 2 links, all fetched
- 1crowdstrike.comCrowdStrike Report
- 2crowdstrike.comEarlier ARTEX Campaigns