Vapor Panda ARTEX Targeted 200 Organizations in 11 Days

The Vapor Panda ARTEX campaign began on 17 October, CrowdStrike says, and within 11 days a single controller of the agentic framework was aimed at more than 200 organizations in at least 14 countries. Post-exploitation was confirmed at nine. For the other 190-plus, the public record shows targeting and, in at least 12 cases, password spraying, not compromise.

What did CrowdStrike confirm about the Vapor Panda ARTEX campaign?

October 17 is the first time CrowdStrike has seen Vapor Panda use AI tooling. From that date, one ARTEX controller was pointed at more than 200 organizations in 11 days, better than 18 a day. That pace shows how fast one controller can be tasked, not how many networks were owned. Targets included foreign ministries in Latin America, Europe, Asia and the Middle East, plus US defense firms, semiconductor companies and telecom providers.

CrowdStrike confirmed post-exploitation at nine organizations, where the group installed the BloodAlchemy backdoor. The public summary names BloodAlchemy as a backdoor and says nothing about its loader or capabilities. Password spraying reached at least 12 more organizations, including US think tanks and European government bodies. Nine confirmed intrusions against more than 200 targets is under 5 percent. Counting the spray targets, CrowdStrike reports activity at 21 or more organizations, and only what its telemetry could see.

ARTEX ran mostly on DeepSeek, with a second commercial model CrowdStrike could not identify. Microsoft has separately reported ARTEX activity by the group it tracks as Storm-0940. CrowdStrike reads that as a sign the framework is catching on among China-nexus groups. The reporting does not say the two groups share victims or operations.

Where did the human stop and the ARTEX agent start?

Recovered transcripts put the human at the decision points and the model on the commands. ARTEX runs a main agent that hands work to planner and worker agents, which record what they learn in a shared graph. The operator set targets and goals, stepping in with instructions written in Chinese. The LLM chose the commands and sent them to the implant.

In a single intrusion, the planning agents consumed roughly 1.4 billion input tokens. The model carries the plan and the working detail, and the operator steps in only when the graph needs a new goal, a supplied file or a stop. CrowdStrike assesses that China-nexus adversaries will highly likely keep adopting frameworks such as ARTEX over the next 12 months, pairing them with commercial LLMs so small teams can scale intrusions across many targets at once.

If you are deploying agents of your own, the same planner-worker loop and shared memory are the trust boundaries an agentic AI threat modeling exercise has to name.

How stale secrets and unvalidated SAML broke the pharmaceutical and Greek targets

Both intrusions CrowdStrike described in detail succeeded through gaps that should already have been closed. At one pharmaceutical firm, the agent paired an unsigned SAML assertion with an XXE flaw, reached the cloud instance metadata service and worked its way up to an enterprise admin account. SAML signature validation and XML external-entity handling are separate controls. IMDSv2 requires a session token obtained through an HTTP PUT before it returns metadata, which breaks many request-forgery paths. It does not fix the XXE bug underneath.

Against a Greek government entity, the operator handed the agent a 2022 directory export from the organization’s mail server. CrowdStrike says it held authentication keys that had likely not been rotated since the export. The agent used them to forge an administrator token and read mailboxes. To reach the internal network, it used VPN configurations recovered from a user’s sent mail, plus a VPN client key the operator described as originating from a May 2024 email leak.

A password reset leaves the 2022 signing key, the VPN key and any sessions they authenticate still valid, so inventory every reusable secret in historical leaks and rotate or revoke it.

SAML and SSO security testing checks assertion signature validation and parser behavior together, the exact pair that failed at the pharmaceutical firm.

How fast did CyberStrikeAI reach domain admin?

It hit educational institutions in several African and Latin American countries, and Kaspersky did not link it to a known group. The tool was CyberStrikeAI, an open-source penetration testing framework written in Go. The model runs on the attacker’s command-and-control server. The implant has no AI built in and executes whatever it receives. We covered that split in an earlier piece on how an LLM sat on C2 in a real intrusion.

Kaspersky describes a single server-side Go process that runs utilities via MCP (Model Context Protocol), handles webshell connections and tasks the implant, while the model analyzes results and decides what to do next.

Access came by hand through a compromised SQL Server, followed by about a day of reconnaissance and two weeks of silence. Once the agent was installed, persistence and local recon took two minutes and domain mapping about five hours. Days later, lateral movement, credential dumping across several hosts and a database export took under an hour. Domain administrator accounts fell three to four days after the agent was deployed.

Kaspersky’s case for a Chinese-speaking operator is indirect: Chinese comments in scripts, use of a Chinese DNS-logging service, and C2 restarts mostly during UTC+8 business hours. On the host, the agent ran Kerberoasting, AS-REP Roasting, LSASS dumps, DCSync and Golden Ticket. The roasting attacks pull encrypted Kerberos material and test candidates offline, so a lockout policy never sees the work.

Does AI on the attacker side change endpoint detection?

Not yet, according to Kaspersky. The intelligent work stays on the attacker’s side, and the compromised host sees ordinary post-exploitation. CrowdStrike adds the condition that matters: detection only helps where it is deployed, and these operators went looking for the gaps.

The three-to-four-day path to domain admin is a response-window problem. A hunt waiting for a novel AI artifact will miss a replication request from a member server and a forged Golden Ticket. A Golden Ticket stays valid until the KRBTGT password is reset twice, with replication between resets.

Our recommendation is to prioritize identity and endpoint telemetry over any AI signature:

• Events 4624 and 4625, with failures aggregated by source across accounts. Spraying tries a few passwords against many accounts to stay under per-account lockout.
• Event 4662 with the DS-Replication-Get-Changes and DS-Replication-Get-Changes-All rights. A replication request from a host that is not a domain controller is the DCSync alert worth paging on.
• Events 4768 and 4769, for ticket requests that line up with AS-REP Roasting and Kerberoasting.
• LSASS access, but only on hosts where an EDR agent is installed and forwarding.

Domain controllers, internet-facing appliances, cloud workloads and remote systems without working EDR or central logs are the blind spots these operators sought.

Run an assumed breach assessment and compare your detection times with Kaspersky’s: two minutes to persist, five hours to map the domain, under an hour for the dump and export, three to four days to domain admin.

CrowdStrike’s advice: rotate keys and credentials after any suspected exposure, enforce SAML signature validation and IMDSv2, hunt for ARTEX markers, patch internet-facing appliances and run EDR everywhere. The public summary does not list the ARTEX markers, so request them from CrowdStrike before you build the hunt.

FAQ

What is the ARTEX framework used by Vapor Panda?

ARTEX is an agentic intrusion framework CrowdStrike first saw Vapor Panda use on 17 October: a main agent delegates to planner and worker agents that share a knowledge graph, mostly on DeepSeek plus an unidentified commercial LLM, with a human setting goals in Chinese and the model choosing commands.

How many organizations did Vapor Panda target, and where was BloodAlchemy installed?

One ARTEX controller was aimed at more than 200 organizations in at least 14 countries within 11 days. CrowdStrike confirmed BloodAlchemy at nine and password spraying against at least 12 others; the 200 figure is targeting scale, not 200 compromises.

What is CyberStrikeAI and how did Kaspersky see it used?

CyberStrikeAI is an open-source Go penetration-testing framework whose model ran on the attacker's C2 while a non-AI implant executed commands. After a hand-driven SQL Server intrusion, a day of recon and about two weeks of silence, the agent reached domain admin in three to four days at educational institutions in Africa and Latin America.

What should defenders do after a suspected ARTEX intrusion?

Rotate every reusable secret from exposed exports and leaks, enforce SAML signature validation and IMDSv2, patch internet-facing appliances, and confirm EDR on domain controllers, appliances, cloud workloads and remote hosts. Hunt aggregated 4625 failures, 4662 replication from non-DCs, 4768 and 4769 ticket requests and LSASS access, and reset KRBTGT twice if a Golden Ticket is in play.

agent::offense measures that clock on your own identity stack in an AI-powered penetration test, from a real foothold to a verified admin action.