Threat reportAPTTL-2026-4779
VAPOR PANDA Uses AI-Driven ARTEX Framework to Scale Global Espionage Campaign (BLOODALCHEMY)
VAPOR PANDA Uses AI-Driven ARTEX Framework to Scale Global (TL-2026-4779), also tracked as ARTEX campaign, is a high-severity advanced persistent threat campaign, first published 2026-10-29 and last reviewed 2026-10-30. It is attributed to VAPOR PANDA (China) with medium confidence, affects Various Internet-facing SAML-based applications, cloud workloads with, maps to 19 MITRE ATT&CK techniques (T1036.005, T1046, T1078), and is covered by 9 detection rules and 24 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 19MITRE ATT&CK
- Actors
- 1VAPOR PANDA
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 24Indicators of compromise
Key facts for TL-2026-4779
- Threat ID
- TL-2026-4779
- Also known as
- ARTEX campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution
- VAPOR PANDA
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- government administration, defense, pharmacy, semi-conductors, nuclear, finance, telecoms, think-tank
- Target regions
- Latin America, Europe, Middle East, North America, Asia
- Detection rules
- 9
- Indicators of compromise
- 24
- Updates
- 2026-10-30 · revalidated 1× · latest source
Malware and tooling in VAPOR PANDA Uses AI-Driven ARTEX Framework to Scale Global
Malware and tooling: BloodAlchemy, ARTEX, Chisel, SoftEther, Tor - S0183
How VAPOR PANDA Uses AI-Driven ARTEX Framework to Scale Global works
CrowdStrike reports the China-nexus adversary VAPOR PANDA used the ARTEX agentic AI framework with commercial and open-source LLMs (including DeepSeek) from October 17-28, 2026 to run simultaneous intrusions against government, defense, pharmaceutical, semiconductor, nuclear and other targets across 14+ countries. It is the actor's first observed AI-driven intrusion tooling, and the agentic workflow includes endpoint sensor evasion. The BLOODALCHEMY backdoor was deployed at multiple compromised entities.
CrowdStrike Counter Adversary Operations assesses that VAPOR PANDA, a China-nexus espionage adversary historically focused on government, think tanks, energy and extractive industries in Europe, North America, Oceania and the UK, adopted the ARTEX agentic AI framework for a campaign beginning October 17, 2026 that touched 200+ organizations in 14+ countries. CrowdStrike confirmed post-exploitation activity at 9 organizations and credential spraying against 12+ additional entities. Victims include foreign ministries in Latin America (two extensively compromised, one likely compromised), a Middle East interior ministry, a European government entity (foreign ministry, presidency, prime minister's office, defense, justice, finance and intelligence), 19 U.S. organizations, telecommunications providers in Belgium and the Philippines, and U.S. pharmaceutical, semiconductor, defense, nuclear, financial services and think-tank targets. The campaign marks an expansion into pharmaceutical, semiconductor, nuclear and defense sectors and an escalation from single intrusions to parallel intrusions directed by one human operator.
ARTEX uses a main agent coordinating subordinate planner and worker agents over a shared fact/goal graph. A single intrusion consumed roughly 1.4 billion input tokens. Operator instructions were written in Chinese, timestamped in China Standard Time and tagged with the marker 【人类指令】 ("human instruction"). The adversary used DeepSeek plus a second subscription-based commercial LLM whose identity is unconfirmed. Agents were directed to find hosts lacking CrowdStrike Falcon sensors using tasklist output and folder listings; the instructions used the PRC red-team slang term for the Falcon sensor. CrowdStrike notes a separate Storm-0940 ARTEX campaign, indicating multiple Chinese actors have adopted the framework.
Observed intrusion chains: at a pharmaceutical organization, unsigned SAML assertion spoofing was chained with XML external entity (XXE) injection to query the cloud Instance Metadata Service, yielding a role able to issue administrative commands to thousands of instances and escalation to an enterprise administrator account. At a second pharmaceutical organization, the actor deployed JSP/PHP web shells, abused an unauthenticated orchestration service for root container access, read LAPS passwords and abused resource-based constrained delegation (RBCD). At a Greek government entity, a 2022 directory export containing unrotated authentication keys was used to forge an administrator mail-server token; VPN configuration files from a user's sent mail plus a leaked VPN client key gave internal network access. Stolen VPN configs and credentials from a May 2024 email leak were also used, and password spraying targeted government, think-tank and corporate accounts.
BLOODALCHEMY was deployed at the Middle East interior ministry and a Latin American foreign ministry. A legitimate GameHook binary renamed svchost.exe side-loads the malicious DLL graphics-hook-filter64.dll, which decrypts the payload graphics-hook_config.bin. The payload contains the internal path D:\ProjectX\Merman_New\. BLOODALCHEMY was first publicly documented by Elastic Security Labs in October 2023 (REF5961 intrusion set). Traffic was proxied through multi-hop infrastructure (Tor, SOCKS proxies, a compromised relay) and tunneled with Chisel and SoftEther. CrowdStrike lists ARTEX hunt markers: command lines containing artx/artex, artx-prefixed cloud roles, art18- comments on administration commands, and the directory C:\ProgramData\artx5v\.
MITRE ATT&CK techniques used in TL-2026-4779
Defense Evasion
T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1574.001 Hijack Execution Flow: DLL
Discovery
T1046 Network Service Discovery; T1518.001 Software Discovery: Security Software Discovery
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application
Command and Control
T1090.003 Proxy: Multi-hop Proxy; T1572 Protocol Tunneling
Credential Access
T1110.003 Brute Force: Password Spraying; T1552.005 Unsecured Credentials: Cloud Instance Metadata API; T1555 Credentials from Password Stores; T1606.002 Forge Web Credentials: SAML Tokens
Collection
T1114.002 Email Collection: Remote Email Collection
Privilege Escalation
T1134.001 Access Token Manipulation: Token Impersonation/Theft
Persistence
T1505.003 Server Software Component: Web Shell
Resource Development
T1588.007 Obtain Capabilities: Artificial Intelligence
Reconnaissance
Execution
Affected products and versions in VAPOR PANDA Uses AI-Driven ARTEX Framework to Scale Global
- Various — Internet-facing SAML-based applications, cloud workloads with IMDSv1, mail servers, VPN services and orchestration services
Vulnerable versions: Configurations lacking SAML signature validation, IMDSv2 enforcement or key rotation
Remediation for VAPOR PANDA Uses AI-Driven ARTEX Framework to Scale Global
Patches
- Patch internet-facing appliances, especially Linux servers, and apply the latest firmware
Immediate actions
- Hunt ARTEX markers: command lines containing 'artx' or 'artex', artx-prefixed cloud roles, 'art18-' comments on cloud administration commands, and the directory C:\ProgramData\artx5v\
- Block and hunt for nginxmysql.com, sqlserver-sqlite.com, www.ddduuuppp.com and IPs 45.153.126.223, 89.46.234.50, 192.121.47.20
- Hunt for renamed svchost.exe outside system directories loading graphics-hook-filter64.dll and graphics-hook_config.bin
- Rotate signing keys, pre-authentication keys and service credentials after any exposure, including historical backups and directory exports
Workarounds
- Enforce SAML signature validation and reject unsigned assertions
- Require IMDSv2 on cloud instances
Longer-term hardening
- Deploy real-time EDR across the whole environment including servers considered inaccessible, since the actor specifically hunts for hosts without sensor coverage
- Restrict cloud roles' ability to issue administration commands to the minimum needed
- Monitor for web shells, LAPS password reads and RBCD attribute changes
- Enforce MFA and monitor for password spraying against external identity and mail services
Weaknesses (CWE) in VAPOR PANDA Uses AI-Driven ARTEX Framework to Scale Global
Timeline of VAPOR PANDA Uses AI-Driven ARTEX Framework to Scale Global
- CrowdStrike dates VAPOR PANDA's primary targeting of government, think-tank, energy and extractive organizations to 2021 (month not stated; date approximates the year)
- A directory export from a Greek government entity's mail server containing unrotated authentication keys is created in 2022 (month not stated); the actor later uses it to forge an administrator mail-server token
- The Register reports on the BLOODALCHEMY backdoor and its link to China-aligned operators
- Elastic Security Labs publicly discloses the BLOODALCHEMY backdoor as part of the REF5961 intrusion set
- Email leak in May 2024 (month approximate) is the origin of a VPN client key and VPN configuration data later abused by the actor for internal network access
- ARTEX open-source agentic pentest framework published on GitHub by its developer (handle Autumn-27), per Wiz (month-level date).
- ARTEX developer moved the project to closed source after threat-actor adoption became public, per Wiz.
- VAPOR PANDA's ARTEX-driven campaign begins against 200+ organizations across 14+ countries
- End of the October 17-28 observation window in which CrowdStrike saw simultaneous ARTEX-driven intrusions, with post-exploitation confirmed at 9 organizations and BLOODALCHEMY deployed at a Middle East interior ministry and a Latin American foreign ministry
- CrowdStrike publishes its analysis of VAPOR PANDA's first observed AI-driven intrusion tooling and releases IOCs and ARTEX hunt markers
Update history for TL-2026-4779
- 2026-10-30 — Vapor Panda (China-nexus) Uses AI-Powered ARTEX Pentest Framework Against 200+ Organizations Worldwide: What changed No change to severity (HIGH), exploitability (ACTIVE), status or attribution confidence (MEDIUM); the update is additive context. New indicators (5) 4 behavioral ARTEX markers (artx, art18-, artx-, the 【人类指令】 operator marker) a
Sources cited for VAPOR PANDA Uses AI-Driven ARTEX Framework to Scale Global
- VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign (CrowdStrike)
- Introducing the REF5961 intrusion set (Elastic Security Labs)
- Disclosing the BLOODALCHEMY backdoor (Elastic Security Labs)
- BLOODALCHEMY backdoor (The Register)
- MITRE ATT&CK T1588.007 Obtain Capabilities: Artificial Intelligence
Detection coverage for TL-2026-4779
As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4779 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.