VAPOR PANDA Let AI Agents Loose on 200 Organizations in 11 Days

A China-nexus espionage group that CrowdStrike tracks as VAPOR PANDA pointed the ARTEX agentic AI framework at more than 200 organizations in at least 14 countries over 11 days starting Oct. 17, CrowdStrike says in new research. Nine victims saw hands-on follow-up, including foreign ministries in Latin America and an interior ministry in the Middle East, where the group dropped its BLOODALCHEMY backdoor. CrowdStrike says this is separate from the ARTEX activity Microsoft pinned on Storm-0940 in the ConnectWise supply-chain attack.

nginxmysql[.]com (45.153.126[.]223)
sqlserver-sqlite[.]com (89.46.234[.]50)
www[.]ddduuuppp[.]com (192.121.47[.]20)

C:\ProgramData\artx5v\
graphics-hook-filter64.dll
graphics-hook_config.bin
svchost.exe outside C:\Windows\System32 (renamed GameHook)

Source article: VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign
Publisher: CrowdStrike (Threat Hunting & Intel blog; OverWatch and CrowdStrike Intelligence)
Published: October 29, 2026
URL: https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/

Executive Summary

VAPOR PANDA is CrowdStrike’s name for a China-nexus intrusion adversary that has targeted government, think tank, energy and extractive organizations in Europe, North America, Oceania and the UK since 2021; the post gives no other vendor aliases, and CrowdStrike explicitly separates this activity from the ARTEX operations Microsoft attributes to Storm-0940. From Oct. 17, 2026, over an 11-day window, CrowdStrike OverWatch watched a single ARTEX controller, linked by CrowdStrike Intelligence to VAPOR PANDA infrastructure, drive the agentic framework against more than 200 organizations in at least 14 countries, including foreign ministries in Latin America, Europe, Asia and the Middle East, a European presidency and prime minister’s office, 19 U.S. pharmaceutical, semiconductor, defense, nuclear and financial organizations, and telecoms in the U.S., Belgium and the Philippines. A lead agent coordinated planner and worker agents, mostly on DeepSeek, with a Chinese-speaking operator steering decision points. Initial access came from unsigned SAML assertions, an XXE flaw used to query the cloud metadata service for an administrative role, an unauthenticated container orchestration service, unrotated authentication keys from a 2022 mail-server directory export, and VPN credentials recovered from mailboxes and old leaks. The agents then abused resource-based constrained delegation, read LAPS passwords, escalated to enterprise administrator, ran commands across thousands of cloud instances through a systems manager, forged a mail administrator token to read mailboxes, and hunted for Windows hosts without an EDR sensor. At nine organizations the group deployed the BLOODALCHEMY backdoor via a renamed GameHook svchost.exe side-loading graphics-hook-filter64.dll, alongside JSP and PHP web shells, Chisel, SoftEther, Tor and SOCKS proxies. The objective is espionage against diplomatic, government and high-technology targets. Hunt leads, false positive expectations and indicators are detailed below; the source publishes no detection rules.

ATT&CK chain: Resource Development → Initial Access → Execution → Persistence → Privilege Escalation → Defense Evasion → Credential Access → Discovery → Collection → Command and Control

Hunt Lead Grid

BLOODALCHEMY Infrastructure and File Sweep

At a Middle East interior ministry and a Latin American foreign ministry, VAPOR PANDA deployed BLOODALCHEMY, a backdoor first documented publicly in October 2023, staging all three components in exposed open directories. The chain is a legitimate GameHook binary renamed svchost.exe, the loader DLL graphics-hook-filter64.dll, and the encrypted payload graphics-hook_config.bin; the implant carries the internal project path D:\ProjectX\Merman_New\. CrowdStrike lists three C2 domains with their resolutions: nginxmysql[.]com (45.153.126[.]223), sqlserver-sqlite[.]com (89.46.234[.]50) and www[.]ddduuuppp[.]com (192.121.47[.]20). The detection logic is a retrospective search for the domains in DNS, proxy and TLS SNI logs, the IPs in firewall and NetFlow records, and the two malicious file names and SHA-256 values in EDR file telemetry, plus a string search of memory or files for Merman_New.

Use DNS resolver, proxy, firewall, NetFlow and EDR file-creation data, sweeping back at least to early October 2026 and preferably 12 months, because the group has operated since 2021 and BLOODALCHEMY predates this campaign. The domain names imitate database and web-server software, so do not add broad allowlists for “mysql” or “sqlserver” strings that would hide them. Do not block the GameHook hash: it is a legitimate binary and blocking it can break the software it belongs to; detect the renamed copy by path instead (next lead). Treat IP-only matches as leads to verify, since hosting addresses get reassigned, but any domain or payload-hash hit on a government, diplomatic, telecom or high-tech network should go straight to incident response.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Defense Evasion → T1574.001 (Hijack Execution Flow: DLL); Command and Control → T1090.003 (Proxy: Multi-hop Proxy) (mapping per source article)

Sources: “VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign”, CrowdStrike, Oct. 29, 2026, https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/ (source article)

ARTEX Operator Markers

CrowdStrike highlights several fingerprints ARTEX left in victim environments: command-line parameters containing “artx” or “artex”, cloud IAM roles created with an “artx” prefix, administration-command comments beginning “art18-“, and the working directory C:\ProgramData\artx5v\. In one pharmaceutical intrusion the agents escalated from a cloud role to sending commands to thousands of instances through a cloud systems manager, which is where those role names and command comments surface. The detection logic is a string hunt across EDR command-line telemetry, cloud audit logs (role creation events and systems-manager command invocations, including their comment fields) and file telemetry for the directory, with any match surfaced as a high-priority alert.

Use EDR process telemetry on Windows and Linux, cloud control-plane audit logs for IAM role creation and systems-manager or run-command events, and file creation events under C:\ProgramData. Sweep from Oct. 1, 2026, to today, and keep the rule live, since the markers are tied to the framework rather than to VAPOR PANDA alone and may appear in other operators’ use of ARTEX. Match case-insensitively but on whole tokens or prefixes (“artx” at the start of a role name, “art18-” at the start of a comment) to avoid collisions with unrelated words. The strings are cheap for an operator to change, so pair this lead with the behavioral ones below rather than relying on it alone. A role or command comment with these prefixes is a confirmed compromise of the cloud account: revoke the role, review every instance it touched and escalate.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Execution → T1651 (Cloud Administration Command) (mapping per source article)

Sources: “VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign”, CrowdStrike, Oct. 29, 2026, https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/ (source article)

Renamed GameHook svchost Side-Loading

BLOODALCHEMY launches through DLL side-loading: a genuine GameHook executable, renamed to svchost.exe so it blends into process lists, loads graphics-hook-filter64.dll from its own folder, and that DLL decrypts and runs graphics-hook_config.bin. The files were staged from open directories rather than installed by any game software. The detection logic is a process rule for any image named svchost.exe running from a path other than C:\Windows\System32\ or C:\Windows\SysWOW64\, or whose parent is not services.exe, joined with an image-load rule for a graphics-hook*.dll loaded by a process named svchost, and a file rule for graphics-hook_config.bin written outside a game-capture product’s install folder.

Use EDR process creation, module load and file events (Sysmon event IDs 1, 7 and 11 work). Sweep 90 days, longer on servers and diplomatic workstations. Mislocated svchost is a well-known masquerade with very few legitimate exceptions, so alert without heavy tuning; the original-filename field in the PE version info, where your EDR records it, will expose the GameHook binary even after renaming. Hash blocking is the wrong control for the loader host because it is a legitimate signed file used under a false name, and the payload is encrypted per deployment. This lead generalizes to the many China-nexus groups that side-load through renamed legitimate binaries. Any confirmed hit should be escalated and the folder preserved, since all three files are needed to recover the payload.

Hunt Lead Level: 2 (Pro)

ATT&CK: Defense Evasion → T1574.001 (Hijack Execution Flow: DLL), T1036.005 (Masquerading: Match Legitimate Resource Name or Location) (mapping per source article)

Sources: “VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign”, CrowdStrike, Oct. 29, 2026, https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/ (source article)

Metadata Service Role Theft From Web Application Hosts

At one U.S. pharmaceutical organization the agents exploited an XML external entity flaw in a web application to make the server query the cloud Instance Metadata Service and return credentials for a role with administrative permissions, then used that role to reach an enterprise administrator account and run commands on thousands of instances. CrowdStrike recommends requiring IMDSv2, which blocks this kind of request forgery. The detection logic has two parts: on the host, metadata-service requests (169.254.169.254) made without a session token or originating from a web server or XML-parsing process rather than the cloud agent or SDK; and in the cloud audit trail, temporary credentials issued to an instance role being used from a source IP that is not that instance, followed by role creation or mass systems-manager command execution.

Use cloud control-plane logs (the provider’s credential-exfiltration finding, if your cloud offers one, covers part of this), VPC or host network flow data, web server and WAF logs for XML payloads containing SYSTEM entity references to internal addresses, and IMDS version metrics. Sweep 90 days. Scope first to internet-facing instances whose roles can create roles or run commands fleet-wide. Expect noise from legitimate SDK traffic, so baseline per instance and alert on deviations rather than raw IMDS requests. Simply enforcing IMDSv2 is the right fix, but it is not a detection: keep the off-instance credential-use alert after hardening. Any role credential used off-instance should be revoked and escalated immediately, since this was the bridge to full cloud and domain compromise.

Hunt Lead Level: 2 (Pro)

ATT&CK: Credential Access → T1552.005 (Unsecured Credentials: Cloud Instance Metadata API); Initial Access → T1190 (Exploit Public-Facing Application) (mapping per source article)

Sources: “VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign”, CrowdStrike, Oct. 29, 2026, https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/ (source article)

Forged SAML and Stale-Key Token Use

Two access paths in this campaign required no vulnerability at all. At a U.S. pharmaceutical company an agent submitted an unsigned SAML assertion that the service provider accepted, and at a Greek government entity the agent found authentication keys in a 2022 directory export from the mail server, keys that were likely never rotated, and used them to forge an administrator token and read mailboxes. Elsewhere, VPN configurations recovered from a user’s sent mail and a VPN client key from a May 2024 email leak gave network access. The detection logic correlates three sources: identity-provider and service-provider logs for SAML responses without a valid signature or signed by an unexpected certificate; mail-server or directory logs for administrator tokens issued without a matching interactive authentication; and VPN logs for sessions from new geographies or ASNs using old client certificates, followed within hours by mailbox access or directory queries from the same source.

This needs federation logs from both sides, mail-server audit logs and VPN authentication records joined in a SIEM, with a baseline of expected signing certificates per relying party and of which accounts normally hold mail-admin tokens. Sweep back to the oldest retained logs, since the keys involved dated from 2022 and 2024 and could have been abused before this campaign. Expect false positives from test SAML integrations and VPN users who travel; allowlist those by relying-party ID and device certificate rather than by user. The right remediation is rotation of every signing key, preauthentication key and VPN credential that ever appeared in a backup, export or breach, together with enforced signature validation; blocking the attacker’s IPs is the wrong control because agents switch infrastructure quickly through Tor and proxies. Any accepted unsigned assertion or token minted from a retired key is a confirmed intrusion and should go to incident response.

Hunt Lead Level: 3 (Elite)

ATT&CK: Credential Access → T1606.002 (Forge Web Credentials: SAML Tokens), T1606 (Forge Web Credentials); Initial Access → T1133 (External Remote Services); Collection → T1114.002 (Email Collection: Remote Email Collection) (mapping per source article)

Sources: “VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign”, CrowdStrike, Oct. 29, 2026, https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/ (source article)

Hash Appendix

BLOODALCHEMY side-loading set

SHA-256 values come from the source article. The source publishes no MD5 or SHA-1 values; AlienVault OTX and VirusTotal were not queried in this run.

MD5s
(not available)  # svchost.exe (renamed GameHook binary)
(not available)  # graphics-hook-filter64.dll -> BLOODALCHEMY loader
(not available)  # graphics-hook_config.bin -> BLOODALCHEMY encrypted payload

SHA1s
(not available)  # svchost.exe (renamed GameHook binary)
(not available)  # graphics-hook-filter64.dll -> BLOODALCHEMY loader
(not available)  # graphics-hook_config.bin -> BLOODALCHEMY encrypted payload

SHA256s
49fe70419fd19b81ca8d730a6ef7c1ec71b681d60b390761070d42686c7d2068  # svchost.exe (renamed GameHook binary)
3fb5a9fb3e2cb1d6208966bd4e55d10282d19c7250d827efa560463d60a12ee4  # graphics-hook-filter64.dll -> BLOODALCHEMY loader
364251838edfcf5ef1107fa692da3c5bd9a540482449f645992830134bf807ab  # graphics-hook_config.bin -> BLOODALCHEMY encrypted payload

Note: the svchost.exe file is an unmodified legitimate GameHook binary used under a deceptive name. Blocking its hash would break legitimate software; detect the name, path and loaded DLL instead.

References Appendix

• “VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign”, CrowdStrike, Oct. 29, 2026, https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/ (source article; victimology, access paths, ARTEX markers, IOCs, ATT&CK mapping)
• MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/