# AI agent frameworks ARTEX (Vapor Panda, Storm-0940) and CyberStrikeAI scale China-linked intrusion campaigns

> CrowdStrike tracks China-nexus VAPOR PANDA using the agentic ARTEX framework (DeepSeek plus an unidentified commercial LLM) from October 17, 2026 against 200+ organizations in 14+ countries in 11 days, with BLOODALCHEMY deployed at nine confirmed victims. Separately, Microsoft attributes ARTEX-driven password spraying and OAuth abuse (ConnectWise cloud supply-chain attack) to Storm-0940, and Kaspersky documents Chinese-speaking operators using the open-source Go framework CyberStrikeAI against educational institutions in Africa and Latin America.

- **Published:** 2026-11-03T12:51:32Z
- **Last reviewed:** 2026-11-04T02:44:38.846Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5152
- **ID:** TL-2026-5152
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** VAPOR PANDA (China)
- **Detections:** 9 (1 shown free below) · **IOCs:** 30 (3 shown free below)

## Description

VAPOR PANDA (China-nexus, active since 2021 against government, think tanks and energy) was observed by CrowdStrike OverWatch from October 17 to 28, 2026 running ARTEX, an agentic framework in which a main agent delegates to planner and worker agents that share a graph of facts, findings and goals. The framework was paired with DeepSeek and a second, unconfirmed commercial subscription LLM. A human operator issued timestamped Chinese-language instructions and intervened at key decision points; one intrusion consumed roughly 1.4 billion input tokens across planning agents. Public reporting describes request rates as high as one every 10 seconds and over 1,500 commands per hour. Targets included foreign ministries in Latin America, Europe, Asia and the Middle East, a near-complete set of government bodies in one European country, 19 US organizations in pharmaceutical, semiconductor, defense, nuclear and financial sectors, and telecom providers in Belgium, the Philippines and Greece. Post-exploitation was confirmed at 9 organizations and password spraying/scanning at 12+ more.

Observed VAPOR PANDA tradecraft: chaining unsigned SAML assertions with XXE to reach cloud instance metadata services and obtain enterprise admin access; web shells (JSP/PHP) plus an unauthenticated orchestration service to reach root container access and extract LAPS passwords; forged administrator tokens using unrotated authentication keys from a 2022 mail-server directory export; and VPN credentials from a May 2024 email leak. Operators explicitly instructed agents to find Windows hosts without the Falcon sensor. The BLOODALCHEMY backdoor was deployed via DLL hijacking of a legitimate GameHook binary (renamed svchost.exe) loading graphics-hook-filter64.dll, which decrypts graphics-hook_config.bin. Tunneling and proxying used Chisel, SoftEther, Tor and SOCKS. ARTEX artifacts include C:\ProgramData\artx5v\, 'artx'/'artex' command-line strings, artx-prefixed cloud roles and 'art18-' comments in administration commands.

Microsoft separately attributes ARTEX use to Storm-0940 (China state-aligned, active since 2021, historically linked to the Quad7/CovertNetwork-1658 password-spray botnet). In October 2026 the actor ran a cross-tenant spray (Oct 10-14, 151,000+ failed sign-ins, peaks of ~2,900 attempts per minute, 2,250+ tenants) and gained access to ConnectWise cloud application identities on Oct 15, then used Microsoft Graph reconnaissance and application credential additions for persistence; some victims reached privileged cloud access in under three hours. Reporting says ARTEX is a Go multi-agent framework with a Next.js frontend that was originally open-source and was later closed by its developer after abuse disclosures (CrowdStrike calls it open-source; sources differ on current status). Observed model backends include DeepSeek, GLM and Grok through OpenAI-compatible gateways.

Kaspersky's CyberStrikeAI cases are not attributed to a named group. CyberStrikeAI is an Apache-2.0 Go framework with MCP-native tool integration and 100+ tool recipes. The LLM orchestrator runs only on the C2 server; C2 functions are exposed to the model as MCP tools and the implant is a conventional C2 agent with no local AI. Intrusions began from a compromised SQL Server (16.0.1000, sqlservr.exe context), used Base64 PowerShell and scheduled tasks ('SystemUpdate') for SYSTEM-level persistence, dnslog[.]cn for external-IP detection, comsvcs.dll MiniDump for LSASS, renamed mimikatz for DCSync/Golden Ticket, Impacket WMIExec and WMI for lateral movement, and database export. In one case, 2 minutes were spent on persistence and local recon, 5 hours on domain recon, and domain compromise followed 3-4 days after agent deployment. Attribution indicators are Chinese-language code comments, dnslog[.]cn use and C2 server restarts concentrated in UTC+8 business hours. Source note: BeaconBeagle was unreachable (HTTP 502) at research time, so no C2 correlation was recorded.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1133 External Remote Services
- T1059.001 PowerShell
- T1651 Cloud Administration Command
- T1047 Windows Management Instrumentation
- T1053.005 Scheduled Task
- T1547.001 Registry Run Keys / Startup Folder
- T1505.003 Web Shell
- T1098.001 Additional Cloud Credentials
- T1134.001 Token Impersonation/Theft
- T1574.001 DLL
- T1036.005 Match Legitimate Resource Name or Location
- T1110.003 Password Spraying
- T1003.001 LSASS Memory
- T1003.006 DCSync
- T1558.001 Golden Ticket
- T1558.003 Kerberoasting
- T1558.004 AS-REP Roasting
- T1552.005 Cloud Instance Metadata API
- T1518.001 Security Software Discovery
- T1021.002 SMB/Windows Admin Shares
- T1114.002 Remote Email Collection
- T1090.003 Multi-hop Proxy
- T1588.007 Obtain Capabilities: Artificial Intelligence
- T1078.004 Valid Accounts: Cloud Accounts
- T1199 Trusted Relationship
- T1528 Steal Application Access Token
- T1550.001 Use Alternate Authentication Material: Application Access Token
- T1087.004 Account Discovery: Cloud Account
- T1526 Cloud Service Discovery

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CyberStrikeAI Exploitation — SQL Server (sqlservr.exe) Spawning Shell or Encoded PowerShell (TL-2026-5152)** (`TL-2026-5152-SPL-001`)

Detects the initial-access pattern documented by Kaspersky for CyberStrikeAI intrusions (TL-2026-5152): a compromised SQL Server (sqlservr.exe context) spawning PowerShell, cmd, WMIC, certutil, schtasks or bitsadmin, with Base64 (-enc) PowerShell flagged as the highest-risk variant. The SQL Server service should almost never launch interactive shells or LOLBins, so a hit indicates xp_cmdshell abuse or exploitation of the database host.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059.001
- **Data sources:** sysmon, windows_security, defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h ParentImage="*\\sqlservr.exe" (Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\cmd.exe" OR Image="*\\wmic.exe" OR Image="*\\certutil.exe" OR Image="*\\schtasks.exe" OR Image="*\\bitsadmin.exe")
```Sysmon EID 1: SQL Server service spawning a shell or LOLBin (CyberStrikeAI initial access, TL-2026-5152)```
| eval encoded_ps=if(match(CommandLine,"(?i)\s-(e|ec|en|enc|encodedcommand)\s+[A-Za-z0-9+/=]{20,}"),1,0)
| stats count min(_time) AS first_seen max(_time) AS last_seen values(Image) AS child_processes values(CommandLine) AS command_lines values(User) AS users BY host ParentImage encoded_ps
| convert ctime(first_seen) ctime(last_seen)
| sort - encoded_ps - count
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "sqlservr.exe"
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "wmic.exe", "certutil.exe", "schtasks.exe", "bitsadmin.exe")
| extend EncodedPowerShell = ProcessCommandLine matches regex @"(?i)\s-(e|ec|en|enc|encodedcommand)\s+[A-Za-z0-9+/=]{20,}"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, EncodedPowerShell, SHA256
| order by EncodedPowerShell desc, Timestamp desc
```

### Sigma

```yaml
title: SQL Server Spawning Shell or Encoded PowerShell (CyberStrikeAI Initial Access)
id: 3b8f2c1e-5a47-4d9b-9e21-7c6a4f0d1b01
status: experimental
description: Detects sqlservr.exe spawning PowerShell, cmd, WMIC, certutil, schtasks or bitsadmin, the initial-access and execution pattern seen in CyberStrikeAI intrusions (TL-2026-5152) that began from a compromised SQL Server.
references:
  - https://securelist.com/tr/cyberstrikeai-attacks/121715/
  - https://labs.cloudsecurityalliance.org/research/csa-research-note-cyberstrikeai-artex-multi-agent-offense-20/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\sqlservr.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wmic.exe'
      - '\certutil.exe'
      - '\schtasks.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Database administrators using xp_cmdshell for documented maintenance jobs
  - SQL Server Agent jobs of type CmdExec or PowerShell
level: high
```

**Known false positives:**

- DBA maintenance using xp_cmdshell for documented jobs
- SQL Server Agent CmdExec or PowerShell job steps

**Tuning notes:** Allowlist known job command lines and service accounts per SQL host, keep encoded_ps=1 as the paging tier, and adjust the index name to wherever Sysmon is ingested. Disable xp_cmdshell where it is not needed.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ARTEX / Storm-0940 Distributed Password Spray Against Entra ID (locked: unlock with TL Creds)
- ARTEX / Storm-0940 Application Credential and Owner Additions for Cloud Persistence (locked: unlock with TL Creds)
- CyberStrikeAI Lateral Movement — Impacket WMIExec and Remote WMIC Process Creation (locked: unlock with TL Creds)
- ARTEX Exploitation — Web Application Process Querying Cloud Instance Metadata Service (locked: unlock with TL Creds)
- BLOODALCHEMY DLL Sideloading via Renamed GameHook svchost.exe and ARTEX Staging Path (locked: unlock with TL Creds)
- CyberStrikeAI Credential Dumping — comsvcs.dll MiniDump, Renamed Mimikatz and Registry Hive Export (locked: unlock with TL Creds)
- CyberStrikeAI Post-Exploitation — 'SystemUpdate' SYSTEM Scheduled Task Persistence (locked: unlock with TL Creds)
- BLOODALCHEMY / CyberStrikeAI / ARTEX C2 Infrastructure Connections and [indicator] Lookups (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 30)

Defanged, TLP:CLEAR.

- IP address: `45.153.126[.]223`
- Domain: `nginxmysql[.]com`
- File hash: `49fe70419fd19b81ca8d730a6ef7c1ec71b681d60b390761070d42686c7d2068`

Full set of 30 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [AI agents scale and speed up Chinese-linked attacks (Help Net Security)](https://www.helpnetsecurity.com/2026/11/03/ai-powered-cyberattacks-artex-cyberstrikeai/)
- [VAPOR PANDA uses ARTEX to scale global campaign (CrowdStrike)](https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/)
- [CyberStrikeAI attacks (Kaspersky Securelist)](https://securelist.com/tr/cyberstrikeai-attacks/121715/)
- [China-linked hackers use ARTEX AI (The Hacker News)](https://thehackernews.com/2026/10/china-linked-hackers-use-artex-ai.html)
- [Multi-Agent Offensive Frameworks in the Wild: CyberStrikeAI and ARTEX (Cloud Security Alliance)](https://labs.cloudsecurityalliance.org/research/csa-research-note-cyberstrikeai-artex-multi-agent-offense-20/)
- [Hackers used AI to speed up ConnectWise cloud backup attack (Redmondmag)](https://redmondmag.com/articles/2026/10/22/hackers-used-ai-to-speed-up-connectwise-cloud-backup-attack.aspx)
- [Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack (Dark Reading)](https://darkreading.com/cyberattacks-data-breaches/microsoft-storm-0940-connectwise-supply-chain-attack)
- [China cyber ConnectWise AI (The Record)](https://therecord.media/china-cyber-connectwise-ai)
- [Tracking CyberStrikeAI Usage (Team Cymru)](https://www.team-cymru.com/post/tracking-cyberstrikeai-usage)
- [CyberStrikeAI tool adopted by hackers for AI-powered attacks (BleepingComputer)](https://www.bleepingcomputer.com/news/security/cyberstrikeai-tool-adopted-by-hackers-for-ai-powered-attacks/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5152