# VAPOR PANDA Uses AI-Driven ARTEX Framework to Scale Global Espionage Campaign (BLOODALCHEMY)

> CrowdStrike reports the China-nexus adversary VAPOR PANDA used the ARTEX agentic AI framework with commercial and open-source LLMs (including DeepSeek) from October 17-28, 2026 to run simultaneous intrusions against government, defense, pharmaceutical, semiconductor, nuclear and other targets across 14+ countries. It is the actor's first observed AI-driven intrusion tooling, and the agentic workflow includes endpoint sensor evasion. The BLOODALCHEMY backdoor was deployed at multiple compromised entities.

- **Published:** 2026-10-29T23:23:21Z
- **Last reviewed:** 2026-10-30T23:03:39.643Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4779
- **ID:** TL-2026-4779
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** VAPOR PANDA (China)
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)

## Description

CrowdStrike Counter Adversary Operations assesses that VAPOR PANDA, a China-nexus espionage adversary historically focused on government, think tanks, energy and extractive industries in Europe, North America, Oceania and the UK, adopted the ARTEX agentic AI framework for a campaign beginning October 17, 2026 that touched 200+ organizations in 14+ countries. CrowdStrike confirmed post-exploitation activity at 9 organizations and credential spraying against 12+ additional entities. Victims include foreign ministries in Latin America (two extensively compromised, one likely compromised), a Middle East interior ministry, a European government entity (foreign ministry, presidency, prime minister's office, defense, justice, finance and intelligence), 19 U.S. organizations, telecommunications providers in Belgium and the Philippines, and U.S. pharmaceutical, semiconductor, defense, nuclear, financial services and think-tank targets. The campaign marks an expansion into pharmaceutical, semiconductor, nuclear and defense sectors and an escalation from single intrusions to parallel intrusions directed by one human operator.

ARTEX uses a main agent coordinating subordinate planner and worker agents over a shared fact/goal graph. A single intrusion consumed roughly 1.4 billion input tokens. Operator instructions were written in Chinese, timestamped in China Standard Time and tagged with the marker 【人类指令】 ("human instruction"). The adversary used DeepSeek plus a second subscription-based commercial LLM whose identity is unconfirmed. Agents were directed to find hosts lacking CrowdStrike Falcon sensors using tasklist output and folder listings; the instructions used the PRC red-team slang term for the Falcon sensor. CrowdStrike notes a separate Storm-0940 ARTEX campaign, indicating multiple Chinese actors have adopted the framework.

Observed intrusion chains: at a pharmaceutical organization, unsigned SAML assertion spoofing was chained with XML external entity (XXE) injection to query the cloud Instance Metadata Service, yielding a role able to issue administrative commands to thousands of instances and escalation to an enterprise administrator account. At a second pharmaceutical organization, the actor deployed JSP/PHP web shells, abused an unauthenticated orchestration service for root container access, read LAPS passwords and abused resource-based constrained delegation (RBCD). At a Greek government entity, a 2022 directory export containing unrotated authentication keys was used to forge an administrator mail-server token; VPN configuration files from a user's sent mail plus a leaked VPN client key gave internal network access. Stolen VPN configs and credentials from a May 2024 email leak were also used, and password spraying targeted government, think-tank and corporate accounts.

BLOODALCHEMY was deployed at the Middle East interior ministry and a Latin American foreign ministry. A legitimate GameHook binary renamed svchost.exe side-loads the malicious DLL graphics-hook-filter64.dll, which decrypts the payload graphics-hook_config.bin. The payload contains the internal path D:\ProjectX\Merman_New\. BLOODALCHEMY was first publicly documented by Elastic Security Labs in October 2023 (REF5961 intrusion set). Traffic was proxied through multi-hop infrastructure (Tor, SOCKS proxies, a compromised relay) and tunneled with Chisel and SoftEther. CrowdStrike lists ARTEX hunt markers: command lines containing artx/artex, artx-prefixed cloud roles, art18- comments on administration commands, and the directory C:\ProgramData\artx5v\.

## MITRE ATT&CK

- T1588.007 Obtain Capabilities: Artificial Intelligence
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1133 External Remote Services
- T1651 Cloud Administration Command
- T1505.003 Server Software Component: Web Shell
- T1134.001 Access Token Manipulation: Token Impersonation/Theft
- T1574.001 Hijack Execution Flow: DLL
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1552.005 Unsecured Credentials: Cloud Instance Metadata API
- T1555 Credentials from Password Stores
- T1606.002 Forge Web Credentials: SAML Tokens
- T1110.003 Brute Force: Password Spraying
- T1518.001 Software Discovery: Security Software Discovery
- T1114.002 Email Collection: Remote Email Collection
- T1090.003 Proxy: Multi-hop Proxy
- T1572 Protocol Tunneling
- T1595.002 Active Scanning
- T1046 Network Service Discovery

## Sources

- [VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign (CrowdStrike)](https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/)
- [Introducing the REF5961 intrusion set (Elastic Security Labs)](https://www.elastic.co/security-labs/introducing-the-ref5961-intrusion-set)
- [Disclosing the BLOODALCHEMY backdoor (Elastic Security Labs)](https://www.elastic.co/security-labs/threat-command/disclosing-the-bloodalchemy-backdoor)
- [BLOODALCHEMY backdoor (The Register)](https://www.theregister.com/2023/10/16/bloodalchemy_backdoor)
- [MITRE ATT&CK T1588.007 Obtain Capabilities: Artificial Intelligence](https://attack.mitre.org/techniques/T1588/007/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4779