Skip to navigation

Threat reportAPTTL-2026-5152

AI agent frameworks ARTEX (Vapor Panda, Storm-0940) and CyberStrikeAI scale China-linked intrusion campaigns

highACTIVE

CrowdStrike tracks China-nexus VAPOR PANDA using the agentic ARTEX framework (DeepSeek plus an unidentified commercial LLM) from October 17, 2026 against 200+ organizations in 14+ countries in 11 days, with BLOODALCHEMY deployed at nine confirmed victims. Separately, Microsoft attributes ARTEX-driven password spraying and OAuth abuse (ConnectWise cloud supply-chain attack) to Storm-0940, and Kaspersky documents Chinese-speaking operators using the open-source Go framework CyberStrikeAI against educational institutions in Africa and Latin America. First disclosed .

Key facts for VAPOR PANDA ARTEX campaign

IdentifiersTL-2026-5152
Also known asARTEX campaign, CyberStrikeAI campaign
SeverityHIGH
First disclosed
Exploitation statusExploited in the wild
Affected productsConnectWise ConnectWise Cloud Backup application identities; Microsoft Entra ID / Microsoft 365 tenants (password spray, OAuth application abuse); Microsoft SQL Server 16.0.1000 (compromised initial access host in CyberStrikeAI cases); Okta Okta corporate sign-in (password spray target per Wiz via THN)
Weaknesses (CWE)CWE-611, CWE-347, CWE-798
AttributionVAPOR PANDA (medium confidence)
Nation-state nexusChina
MalwareBloodAlchemy, Storm
ToolsARTEX, Chisel, ConnectWise - S0591, CyberStrikeAI, Tor - S0183
MITRE ATT&CK techniquesT1003.001 LSASS Memory, T1003.006 DCSync, T1021.002 SMB/Windows Admin Shares, T1036.005 Match Legitimate Resource Name or Location, T1047 Windows Management Instrumentation, T1053.005 Scheduled Task, T1059.001 PowerShell, T1078 Valid Accounts, T1078.004 Valid Accounts: Cloud Accounts, T1087.004 Account Discovery: Cloud Account, T1090.003 Multi-hop Proxy, T1098.001 Additional Cloud Credentials and 20 more in the attack flow
MotivationESPIONAGE
Target sectorsgovernment administration, foreign ministries, defense, semi-conductors, pharmacy, nuclear, finance, telecoms, education, think tanks, aerospace, energy
Target regionsLatin America, Europe, Asia, Middle East, North America, Africa
Detection rules9 (1 shown free)
Sources10 cited sources

Detection coverage for VAPOR PANDA ARTEX campaign

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5152 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CyberStrikeAI Exploitation — SQL Server (sqlservr.exe) Spawning Shell or Encoded PowerShell (TL-2026-5152)

Detects the initial-access pattern documented by Kaspersky for CyberStrikeAI intrusions (TL-2026-5152): a compromised SQL Server (sqlservr.exe context) spawning PowerShell, cmd, WMIC, certutil, schtasks or bitsadmin, with Base64 (-enc) PowerShell flagged as the highest-risk variant. The SQL Server service should almost never launch interactive shells or LOLBins, so a hit indicates xp_cmdshell abuse or exploitation of the database host.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1190, T1059.001
  • Data sources: sysmon, windows_security, defender_for_endpoint
  • Severity: high
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h ParentImage="*\\sqlservr.exe" (Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\cmd.exe" OR Image="*\\wmic.exe" OR Image="*\\certutil.exe" OR Image="*\\schtasks.exe" OR Image="*\\bitsadmin.exe")
```Sysmon EID 1: SQL Server service spawning a shell or LOLBin (CyberStrikeAI initial access, TL-2026-5152)```
| eval encoded_ps=if(match(CommandLine,"(?i)\s-(e|ec|en|enc|encodedcommand)\s+[A-Za-z0-9+/=]{20,}"),1,0)
| stats count min(_time) AS first_seen max(_time) AS last_seen values(Image) AS child_processes values(CommandLine) AS command_lines values(User) AS users BY host ParentImage encoded_ps
| convert ctime(first_seen) ctime(last_seen)
| sort - encoded_ps - count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "sqlservr.exe"
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "wmic.exe", "certutil.exe", "schtasks.exe", "bitsadmin.exe")
| extend EncodedPowerShell = ProcessCommandLine matches regex @"(?i)\s-(e|ec|en|enc|encodedcommand)\s+[A-Za-z0-9+/=]{20,}"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, EncodedPowerShell, SHA256
| order by EncodedPowerShell desc, Timestamp desc

Sigma

title: SQL Server Spawning Shell or Encoded PowerShell (CyberStrikeAI Initial Access)
id: 3b8f2c1e-5a47-4d9b-9e21-7c6a4f0d1b01
status: experimental
description: Detects sqlservr.exe spawning PowerShell, cmd, WMIC, certutil, schtasks or bitsadmin, the initial-access and execution pattern seen in CyberStrikeAI intrusions (TL-2026-5152) that began from a compromised SQL Server.
references:
  - https://securelist.com/tr/cyberstrikeai-attacks/121715/
  - https://labs.cloudsecurityalliance.org/research/csa-research-note-cyberstrikeai-artex-multi-agent-offense-20/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\sqlservr.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wmic.exe'
      - '\certutil.exe'
      - '\schtasks.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Database administrators using xp_cmdshell for documented maintenance jobs
  - SQL Server Agent jobs of type CmdExec or PowerShell
level: high

Known false positives:

  • DBA maintenance using xp_cmdshell for documented jobs
  • SQL Server Agent CmdExec or PowerShell job steps

Tuning notes: Allowlist known job command lines and service accounts per SQL host, keep encoded_ps=1 as the paging tier, and adjust the index name to wherever Sysmon is ingested. Disable xp_cmdshell where it is not needed.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • ARTEX / Storm-0940 Distributed Password Spray Against Entra ID · unlock with TL Creds
  • ARTEX / Storm-0940 Application Credential and Owner Additions for Cloud Persistence · unlock with TL Creds
  • CyberStrikeAI Lateral Movement — Impacket WMIExec and Remote WMIC Process Creation · unlock with TL Creds
  • ARTEX Exploitation — Web Application Process Querying Cloud Instance Metadata Service · unlock with TL Creds
  • BLOODALCHEMY DLL Sideloading via Renamed GameHook svchost.exe and ARTEX Staging Path · unlock with TL Creds
  • CyberStrikeAI Credential Dumping — comsvcs.dll MiniDump, Renamed Mimikatz and Registry Hive Export · unlock with TL Creds
  • CyberStrikeAI Post-Exploitation — 'SystemUpdate' SYSTEM Scheduled Task Persistence · unlock with TL Creds
  • BLOODALCHEMY / CyberStrikeAI / ARTEX C2 Infrastructure Connections and [indicator] Lookups · unlock with TL Creds

Indicators of compromise for VAPOR PANDA ARTEX campaign

As of 2026-11-04, Threadlinqs Intelligence tracks 30 indicators of compromise for TL-2026-5152.

Sample indicators (3 of 30)

  • IP address: 45.153.126[.]223
  • Domain: nginxmysql[.]com
  • File hash: 49fe70419fd19b81ca8d730a6ef7c1ec71b681d60b390761070d42686c7d2068

Defanged, TLP:CLEAR. Full set of 30 indicators: unlock with TL Creds.

30 indicators of compromise · unlock with TL Creds. Compare plans

How VAPOR PANDA ARTEX campaign works

VAPOR PANDA (China-nexus, active since 2021 against government, think tanks and energy) was observed by CrowdStrike OverWatch from October 17 to 28, 2026 running ARTEX, an agentic framework in which a main agent delegates to planner and worker agents that share a graph of facts, findings and goals. The framework was paired with DeepSeek and a second, unconfirmed commercial subscription LLM. A human operator issued timestamped Chinese-language instructions and intervened at key decision points; one intrusion consumed roughly 1.4 billion input tokens across planning agents. Public reporting describes request rates as high as one every 10 seconds and over 1,500 commands per hour. Targets included foreign ministries in Latin America, Europe, Asia and the Middle East, a near-complete set of government bodies in one European country, 19 US organizations in pharmaceutical, semiconductor, defense, nuclear and financial sectors, and telecom providers in Belgium, the Philippines and Greece. Post-exploitation was confirmed at 9 organizations and password spraying/scanning at 12+ more.

Observed VAPOR PANDA tradecraft: chaining unsigned SAML assertions with XXE to reach cloud instance metadata services and obtain enterprise admin access; web shells (JSP/PHP) plus an unauthenticated orchestration service to reach root container access and extract LAPS passwords; forged administrator tokens using unrotated authentication keys from a 2022 mail-server directory export; and VPN credentials from a May 2024 email leak. Operators explicitly instructed agents to find Windows hosts without the Falcon sensor. The BLOODALCHEMY backdoor was deployed via DLL hijacking of a legitimate GameHook binary (renamed svchost.exe) loading graphics-hook-filter64.dll, which decrypts graphics-hook_config.bin. Tunneling and proxying used Chisel, SoftEther, Tor and SOCKS. ARTEX artifacts include C:\ProgramData\artx5v\, 'artx'/'artex' command-line strings, artx-prefixed cloud roles and 'art18-' comments in administration commands.

Microsoft separately attributes ARTEX use to Storm-0940 (China state-aligned, active since 2021, historically linked to the Quad7/CovertNetwork-1658 password-spray botnet). In October 2026 the actor ran a cross-tenant spray (Oct 10-14, 151,000+ failed sign-ins, peaks of ~2,900 attempts per minute, 2,250+ tenants) and gained access to ConnectWise cloud application identities on Oct 15, then used Microsoft Graph reconnaissance and application credential additions for persistence; some victims reached privileged cloud access in under three hours. Reporting says ARTEX is a Go multi-agent framework with a Next.js frontend that was originally open-source and was later closed by its developer after abuse disclosures (CrowdStrike calls it open-source; sources differ on current status). Observed model backends include DeepSeek, GLM and Grok through OpenAI-compatible gateways.

Kaspersky's CyberStrikeAI cases are not attributed to a named group. CyberStrikeAI is an Apache-2.0 Go framework with MCP-native tool integration and 100+ tool recipes. The LLM orchestrator runs only on the C2 server; C2 functions are exposed to the model as MCP tools and the implant is a conventional C2 agent with no local AI. Intrusions began from a compromised SQL Server (16.0.1000, sqlservr.exe context), used Base64 PowerShell and scheduled tasks ('SystemUpdate') for SYSTEM-level persistence, dnslog[.]cn for external-IP detection, comsvcs.dll MiniDump for LSASS, renamed mimikatz for DCSync/Golden Ticket, Impacket WMIExec and WMI for lateral movement, and database export. In one case, 2 minutes were spent on persistence and local recon, 5 hours on domain recon, and domain compromise followed 3-4 days after agent deployment. Attribution indicators are Chinese-language code comments, dnslog[.]cn use and C2 server restarts concentrated in UTC+8 business hours. Source note: BeaconBeagle was unreachable (HTTP 502) at research time, so no C2 correlation was recorded.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.001 LSASS Memory; T1003.006 DCSync; T1110.003 Password Spraying; T1528 Steal Application Access Token; T1552.005 Cloud Instance Metadata API; T1558.001 Golden Ticket; T1558.003 Kerberoasting; T1558.004 AS-REP Roasting

Lateral Movement

T1021.002 SMB/Windows Admin Shares

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1550.001 Use Alternate Authentication Material: Application Access Token; T1574.001 DLL

Execution

T1047 Windows Management Instrumentation; T1053.005 Scheduled Task; T1059.001 PowerShell; T1651 Cloud Administration Command

Initial Access

T1078 Valid Accounts; T1078.004 Valid Accounts: Cloud Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1199 Trusted Relationship

Discovery

T1087.004 Account Discovery: Cloud Account; T1518.001 Security Software Discovery; T1526 Cloud Service Discovery

Command and Control

T1090.003 Multi-hop Proxy

Persistence

T1098.001 Additional Cloud Credentials; T1505.003 Web Shell; T1547.001 Registry Run Keys / Startup Folder

Collection

T1114.002 Remote Email Collection

Privilege Escalation

T1134.001 Token Impersonation/Theft

Resource Development

T1588.007 Obtain Capabilities: Artificial Intelligence

Reconnaissance

T1595.002 Vulnerability Scanning

Remediation for VAPOR PANDA ARTEX campaign

Patches

  • Patch internet-facing appliances, particularly long-lived Linux servers; no CVE was cited in the sources

Immediate actions

  • Hunt for ARTEX markers: C:\ProgramData\artx5v\, 'artx'/'artex' command-line strings, artx-prefixed cloud roles, 'art18-' comments in administration commands
  • Block and hunt for the listed C2 domains and IPs and for dnslog.cn lookups from servers
  • Review service principals for credential additions, new owners, consent grants and privileged role assignments during Oct 1-15, 2026
  • Audit SQL Server hosts for sqlservr.exe spawning PowerShell, scheduled task 'SystemUpdate' and implants in C:\Windows\Temp, C:\ProgramData

Workarounds

  • Alert on LSASS memory access, comsvcs.dll MiniDump and registry hive dumping via reg.exe
  • Alert on WMI/WinRM remote execution across the domain

Longer-term hardening

  • Rotate signing keys, preauthentication keys and service credentials after suspected exposure, including historical directory/mail-server exports and backups
  • Enforce SAML signature validation and require IMDSv2; restrict cloud role command-execution permissions
  • Deploy EDR on all servers including those not exposed to the internet
  • Detect low-frequency distributed password spraying across assets and time rather than relying on single-source rate limits
  • Monitor for calls to unapproved LLM APIs and reseller endpoints
  • Enable Windows audit events 4688, 4104, 4624, 4662, 4663, 5145 and auditd on Linux

Affected and fixed versions

  • ConnectWise — ConnectWise Cloud Backup application identities
  • Microsoft — Entra ID / Microsoft 365 tenants (password spray, OAuth application abuse)
  • Microsoft — SQL Server 16.0.1000 (compromised initial access host in CyberStrikeAI cases)
    Vulnerable versions: 16.0.1000
  • Okta — Okta corporate sign-in (password spray target per Wiz via THN)

Timeline of VAPOR PANDA ARTEX campaign

Last updated · revalidated 1× · latest source

  • Microsoft: as early as September 2026 Storm-0940 uses locked-ioc-30 to automate attacks on hundreds of organizations (month only reported; day is a placeholder).
  • locked-ioc-30 developer announces on GitHub that the tool was abused, will receive no further updates and goes closed source; CrowdStrike notes copies remain freely available on GitHub.
  • Storm-0940 begins a cross-tenant password spray campaign (Oct 10-14) with locked-ioc-30, generating 151,000+ failed sign-ins across 327 accounts at 8 organizations
  • Peak of the Storm-0940 spray: roughly 2,900 failed sign-in attempts per minute and 111,000+ failures in a single day
  • Storm-0940 gains access to multiple ConnectWise cloud application identities, leading to the ConnectWise Cloud Backup supply-chain compromise
  • CrowdStrike OverWatch observes VAPOR PANDA begin using locked-ioc-30 with DeepSeek and a second commercial LLM
  • Press coverage of Microsoft's attribution of the ConnectWise Cloud Backup attack to Storm-0940 using locked-ioc-30 (CSA dates Microsoft's report to Oct 21)
  • End of the 11-day VAPOR PANDA observation window: 200+ organizations in 14+ countries targeted, post-exploitation at 9, spraying at 12+ more
  • CrowdStrike publishes 'VAPOR PANDA uses locked-ioc-30 to scale global campaign'
  • The Register reports the UK NCSC assessment that AI-powered malware is highly likely in ransomware attacks on UK CNI by 2028, citing locked-ioc-30 abuse (forward-looking assessment, no confirmed AI ransomware incident).
  • Help Net Security summarizes the CrowdStrike, Kaspersky and Microsoft findings on locked-ioc-30 and locked-ioc-22

Update history

Sources cited for VAPOR PANDA ARTEX campaign

Drafted by the Threadlinqs research pipeline from 10 sources; published ; last updated .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats