CrowdStrike: VAPOR PANDA Used AI Agent Tool ARTEX Against 200+ Organizations

A campaign built for parallel intrusions

CrowdStrike says the operation marks an escalation in China-nexus use of AI agents, moving from single intrusions to multiple simultaneous engagements directed by a human operator. ARTEX refers to each engagement as a "task".

CrowdStrike has previously documented ARTEX and similar agentic frameworks in use by financially motivated and unattributed actors. In this case, the company says, a targeted intrusion adversary used the framework to work against several high-value targets at once. CrowdStrike also states that the VAPOR PANDA campaign is separate from ARTEX activity recently reported by industry sources under the Storm-0940 designation.

Falcon telemetry also revealed details absent from public ARTEX reporting, according to CrowdStrike, including VAPOR PANDA's deployment of the BLOODALCHEMY backdoor and its command-and-control (C2) infrastructure.

Who was targeted

CrowdStrike OverWatch observed exploitation activity from a single ARTEX controller directed at entities in at least 14 countries over an 11-day window. The controller, which CrowdStrike Intelligence links to VAPOR PANDA infrastructure, intermittently exposed adversary tooling, target files and ARTEX agent transcripts. That exposure points to multiple engagements against multiple targets.

The listed targets include:

• Foreign ministries in Latin America, Europe, Asia and the Middle East, plus semiconductor, defense and think tank organizations in the U.S., and telecommunications providers in multiple regions.
• Two Latin America-based foreign ministries, where VAPOR PANDA conducted extensive intrusions. A third was likely compromised, and target files were staged for use against foreign ministries in Central America and Asia.
• A Middle East-based interior ministry, which the adversary compromised.
• One European country, where the foreign ministry, presidency, prime minister's office and defense, justice, finance and intelligence entities were targeted.
• 19 U.S.-based organizations in the pharmaceutical, semiconductor, defense, nuclear and financial sectors, targeted in a separate engagement.
• Telecommunications providers in the U.S., Belgium and the Philippines, which were compromised.

CrowdStrike Intelligence confirmed post-exploitation activity at nine organizations, where the adversary gained access, deployed BLOODALCHEMY and carried out follow-on credential spraying and network scanning.

Sensor evasion built into the agent workflow

CrowdStrike also points to the way the adversary folded defensive evasion into the automation itself. The operation included instructions within the agentic workflow to identify hosts without the CrowdStrike Falcon sensor, which the company describes as endpoint sensor evasion built directly into the process.

The source text provided is an excerpt and cuts off mid-description of the post-exploitation activity, so further technical detail from the full CrowdStrike post is not covered here.

What it means

The findings, as CrowdStrike presents them, show a targeted espionage actor using commercial and Chinese-developed language models to scale from one intrusion at a time to many concurrent operations steered by a single human operator. For government, defense, semiconductor and telecommunications organizations, the report indicates that AI-driven tooling is already being used in live campaigns against them, and that adversaries are planning around specific security products from the start.