CrowdStrike says VAPOR PANDA used ARTEX against more than 200 organisations; nine confirmed with BLOODALCHEMY

Nine confirmed out of more than 200: what the report's own counts say

CrowdStrike's blog post of 29 October 2026 on VAPOR PANDA and ARTEX says its OverWatch team identified a campaign that began on 17 October 2026 in which the adversary used the ARTEX agent framework against more than 200 distinct organisations. It then says its CrowdStrike Intelligence team confirmed post exploitation activity at nine organisations. Nine is at most 4.5 per cent of 200 (derived, and lower still because the post says more than 200). The post dates the window as 11 days, so it ran from 17 October to about 27 October (derived), two days before the post appeared. This briefing rests on that post, which was read in full on 30 October 2026 between about 18:52 and 19:00 UTC, after reading the vendor's robots file. Two other pages the post links to were also read, for context only.

What the number 200 does not establish is a breach count. The post says ARTEX was used "against" those organisations and that exploitation activity was "directed against entities in at least 14 countries"; it never says that 200 organisations were compromised, and it keeps its confirmed figure for the nine. It does not name the organisations, say how the list was drawn, or say how the 200 was counted. One clue is in the post: the controller "intermittently exposed adversary tooling, target files, and ARTEX agent transcripts". That suggests the target files were a source for the count, but the post does not say so, so treat it as inference.

CrowdStrike sells endpoint security and threat intelligence, and the post closes its advice by recommending its own Falcon sensor. It is also the only source for every figure here. The post names no victim, publishes no log or transcript and gives no confidence level for the attribution, so none of its counts can be checked from outside. That is not a reason to doubt it. It is the reason this briefing keeps what the post states apart from what it leaves out.

Zoom

Reading the numbers: a scale figure, a confirmed figure and a pace

The post gives four counts, and each measures something different. The 200 is a reach figure: organisations that ARTEX was used against. The nine is an outcome figure: organisations where CrowdStrike Intelligence confirmed access and follow on activity. The 12 is an attempt figure, described as at least 12 additional organisations hit by password spraying and credential scanning, with no access stated. The 14 is a geography figure: countries in which exploitation activity was directed. Adding them up would be wrong. The post does not say whether the 12 are inside or outside the 200, so "at least 21 organisations" (9 plus 12, derived) is a floor only if the groups are separate, which "additional" suggests but does not prove.

Spread across the window, more than 200 organisations is about 18 a day on average (derived). That is a pace one operator could set only by running many tasks at once, and the post says exactly that: its transcripts show an operator running multiple engagements, "intervening only to steer the agents at decision points". How many ran side by side is not stated. The post also names the shape of some engagements: one focused on a single European country, targeting its foreign ministry, presidency and prime minister's office, plus defence, justice, finance and intelligence entities; a separate one targeted 19 US organisations in pharmaceutical, semiconductor, defence, nuclear and financial sectors. It does not say which of these are among the nine.

A second report of the same tool puts a different number on a different thing. Microsoft's report of 21 October says Storm 0940 used ARTEX to attempt sign ins to more than 2,250 tenants after a supply chain compromise. Microsoft counts tenants and attempts; CrowdStrike counts organisations and confirmed outcomes. The two cannot be set side by side, and CrowdStrike says its campaign is separate from the Storm 0940 activity. We covered Microsoft's report in an earlier briefing. What the new post adds is a second actor, a different attribution, a window with dates, and a token figure.

The attribution, and the friendly names that carry it

The post's chain of attribution is short. A single ARTEX controller that "CrowdStrike Intelligence has linked to VAPOR PANDA infrastructure" exposed tooling, target files and transcripts. Separately, Falcon telemetry showed BLOODALCHEMY and its command and control infrastructure. The post then calls VAPOR PANDA a China nexus adversary active since 2021 against government, think tank, energy and extractive organisations, and says this is its first observed use of AI driven intrusion tooling and a broadening into pharmaceutical, semiconductor, nuclear and defence sectors and foreign ministries. What the post does not print is how the controller was linked, how strong the link is, or what a China nexus means here. It does not say the adversary is a state organ.

Two labels do work that the evidence has not been asked to do. "AI penetration testing framework" is Microsoft's description of ARTEX in the report linked above. A penetration test is what the activity is called when someone has a contract; the same steps without one are intrusion, and a tool's name says what it can do, not who may point it at what. "AI driven" is the other. The post's own transcripts show an operator writing instructions, so the intrusions were directed by a person and run by agents. That is not the same as unattended, and the post is careful to say "human in the loop".

The post is plain about which assessments are judgement. Its statements about the reasons for the model choice ("likely reflects a deliberate effort" to build a resilient toolchain from several providers) and about future use are marked "likely" and "highly likely". Those are CrowdStrike's forecasts. They are worth reading as the vendor's view, and not as findings.

How ARTEX was run: one operator, planner and worker agents, 1.4 billion tokens

The post describes ARTEX as a main agent with subordinate planner and worker agents over a shared graph of facts, findings and goals, advancing each engagement from initial access through host reconnaissance and lateral movement. Recovered transcripts showed an operator issuing instructions in Chinese, marked with a label meaning human instruction and timestamped in China Standard Time, directing the agents to write web shells, extract domain administrator passwords and inventory endpoint sensor coverage. In the post's words, VAPOR PANDA ran ARTEX primarily on the Chinese origin DeepSeek model, supplemented with a second, subscription based commercial model that CrowdStrike could not confirm.

Zoom

The token figure needs care. The post says that in a single intrusion, planning agents consumed "on the order of 1.4 billion input tokens". Input tokens count the text sent to a model on every call, including context repeated from earlier steps, so the figure measures volume sent, not unique text or work done. The post gives no duration, model, call count or price, so a cost cannot be derived from it. Its own inference is that the whole operation used far more, which is plausible and unmeasured. One further point is inference from the post, not a statement in it: a provider that served that volume holds usage records, and the post says nothing about any provider being told or acting.

One instruction is quoted in the post and deserves its own sentence. At a global pharmaceutical organisation the operator told the agents to find Windows machines in the domain without the CrowdStrike Falcon sensor, judging by task lists and folder listings. The post reads that as sensor coverage checks built into the agent workflow so that follow on activity concentrates on unprotected hosts. Its advice is to deploy an endpoint detection and response agent everywhere, including on servers that seem unreachable. That is sound advice and it is also the vendor's product, which is why the claim should rest on the quoted instruction, shown in the Technical details section, and not on the advice.

Three chains from the transcripts: old keys, a bad assertion, a delegation

The post says the recovered transcripts and staged tooling show an adversary pairing an AI driven workflow with well established tradecraft. It describes three chains. None of them is new, and each stops at a control that was missing or old.

At a US pharmaceutical organisation the agent chained an unsigned SAML assertion and an XML external entity flaw to query the cloud instance metadata service, obtained a role able to issue administration commands to thousands of instances, then escalated to an enterprise administrator account. At a second US pharmaceutical organisation it deployed web shells, abused an unauthenticated orchestration service to get root in a production container environment, read LAPS passwords and abused resource based constrained delegation to impersonate a privileged account. Against a Greek government entity the operator supplied a 2022 directory export from the organisation's mail server holding authentication keys that had likely not been rotated since; the agent forged an administrator token and read mailboxes, then used VPN configurations from a user's sent mail and a VPN client key the operator described as coming from a May 2024 email leak to reach the internal network.

Zoom

The chains show why the agent loop matters less than the inputs. The Greek chain began with a file a human supplied: an export the organisation had likely already exposed, and keys it had not rotated. The agent turned old exposure into access at speed. The sensible reading, and it is ours, is that agents shorten the time between an exposure and its use, and they make every old exposure worth trying. The post's own first recommendation points the same way: rotate keys and credentials after any suspected exposure, including keys in historical backups and directory exports.

What this adds to the earlier ARTEX reports

The post says it is separate from the Storm 0940 activity Microsoft reported, and that CrowdStrike has previously documented ARTEX and similar frameworks in use by financially motivated and unattributed actors. We read that earlier CrowdStrike material through our briefing on a registrar's AI attack claim, which also shows how little a China nexus label can rest on when the evidence is servers and tools.

Three things are new in this post. The first is attribution to a named adversary active since 2021, with a stated first use of AI tooling. The second is a window with dates and a confirmed count against a reach count. The third is a token figure for one intrusion. The post also says BLOODALCHEMY, a backdoor it says was first publicly documented in October 2023, was deployed. Elastic's write up of the backdoor is dated 13 October 2023 and describes a backdoor injected into a signed benign process, with a malicious DLL side loaded by a legitimate binary; the 2026 chain in CrowdStrike's post is also a renamed legitimate binary loading a malicious DLL (a similarity this site notes, not one either report states). Elastic's page does not mention VAPOR PANDA, so the link between the 2023 backdoor and this actor rests on CrowdStrike.

Technical details

CrowdStrike's post prints indicators, file names, hunting markers, one operator instruction and a technique table. Everything below is copied from the post, read on 30 October 2026, with the exceptions noted in the captions and for the table. The post does not print a detection rule, a query, a prompt or a log line, and it publishes no traffic signature for agent activity. The domains and addresses are live infrastructure and are shown defanged, exactly as the post printed them. Nothing here is exploit code.

The first block is CrowdStrike's indicator table: three command and control domains for BLOODALCHEMY, the address each resolves to, and three file hashes. A defender searches DNS, proxy and firewall logs for the domains and addresses, and endpoint telemetry for the hashes. A match is informative. An absence proves little: the post says only that these indicators did not appear in earlier public ARTEX reporting.

nginxmysql[.]com	BLOODALCHEMY C2 domain
45.153.126[.]223	IP address of nginxmysql[.]com
sqlserver-sqlite[.]com	BLOODALCHEMY C2 domain
89.46.234[.]50	IP address of sqlserver-sqlite[.]com
www[.]ddduuuppp[.]com	BLOODALCHEMY C2 domain
192.121.47[.]20	IP address of www[.]ddduuuppp[.]com
49fe70419fd19b81ca8d730a6ef7c1ec71b681d60b390761070d42686c7d2068	GameHook binary renamed svchost.exe
3fb5a9fb3e2cb1d6208966bd4e55d10282d19c7250d827efa560463d60a12ee4	BLOODALCHEMY loader DLL (graphics-hook-filter64.dll)
364251838edfcf5ef1107fa692da3c5bd9a540482449f645992830134bf807ab	BLOODALCHEMY payload file (graphics-hook_config.bin)

The second block is the loader chain the post describes at the Middle East interior ministry and the Latin American foreign ministry. A legitimate GameHook binary, renamed svchost.exe, loaded a malicious DLL that decrypted a payload file; copies of all three were staged in the exposed open directories. The right column is this site's condensation of the post's sentence. The names are copied exactly. A defender looks for a binary called svchost.exe running outside its normal system folder, and for a DLL and a configuration file with these names sitting beside it.

svchost.exe (legitimate GameHook binary, renamed)	loads the malicious DLL
graphics-hook-filter64.dll	malicious DLL, decrypts the payload file
graphics-hook_config.bin	BLOODALCHEMY payload file
D:\ProjectX\Merman_New\	internal project path carried by the implant

The third block is the hunting advice from the post's recommendations: strings to look for in command lines, cloud role names, cloud administration command comments and one directory. These are artefacts of the ARTEX deployment itself, which suggests they are default or habitual settings and may be changed by an operator or by a later version of the framework. That is inference. The post does not say how these markers were found or how stable they are.

command-line parameters containing artx or artex strings
artx-prefixed cloud roles
art18- administration-command comments
the C:\ProgramData\artx5v\ directory

The fourth block is the operator instruction from the post, in Chinese, with the post's own translation, and the label it says marks human instructions in the transcripts. The post says the quoted line was addressed to agents at a global pharmaceutical organisation. For defenders it is a description of intent rather than an indicator: an intruder is inventorying which hosts have no endpoint sensor.

label: 【人类指令】 (the post translates this as "human instruction")
在域里寻找没有装猎鹰的windows机器，从tasklist和文件夹目录判断
CrowdStrike's translation: "find Windows machines in the domain without Falcon, judging by tasklist and folder listings"

The table lists the techniques the post maps to MITRE ATT&CK, in its order. The identifiers and observables are as printed; the technique names are as printed except that dashes and hyphens in the names are written out as spaces or colons by this site, so use the identifier to search.

For defenders, in the order worth doing

The first, second, fourth and ninth items are CrowdStrike's advice, in its words reduced to a line. The others are this site's guidance, derived from the three chains and the operator instruction; the post does not give them. The order is our judgement: it puts the things that stopped a described chain first.

No source read publishes a way to detect agent traffic as such. The post's detections are the markers above, the indicators, and the techniques in its table. Where a reader hears a vendor promise to spot agentic attacks by behaviour, the question to ask is which published signal it uses.

The question that exposes the gap

The record is a count of 200 organisations that ARTEX was used against, nine with confirmed post exploitation, and a transcript in which a person tells agents to find the hosts nobody is watching. If an operator pointed an agent at your estate tonight, which key, export or VPN file from 2022 would it be handed first, and does anyone know it exists?

Key facts