VAPOR PANDA Uses ARTEX and LLMs to Scale Global Espionage Campaign

Oct 29, 2026 · Original article ↗

Summary

CrowdStrike reports VAPOR PANDA used ARTEX with DeepSeek and another LLM for parallel intrusions against 200+ organizations; it confirmed post-exploitation at nine and BLOODALCHEMY deployment at two ministries, with endpoint-sensor evasion built into workflows.

Key points

CrowdStrike observed ARTEX activity beginning October 17, 2026, targeting more than 200 organizations; a single controller directed activity against entities in at least 14 countries over 11 days.
CrowdStrike Intelligence confirmed post-exploitation at nine organizations, including BLOODALCHEMY deployment, credential spraying, network scanning, and reconnaissance.
The operation used DeepSeek and a second commercial LLM with ARTEX's main, planner, and worker agents; recovered transcripts showed a human operator steering activity at decision points.
In one pharmaceutical intrusion, an unsigned SAML assertion and an XXE flaw were used to query cloud instance metadata and obtain a role capable of issuing administration commands.
At a Greek government entity, the operator supplied an old directory export with likely unrotated authentication keys; the agent used them to forge an administrator token and access mailboxes.
At two ministries, a renamed GameHook binary loaded a malicious DLL that decrypted the BLOODALCHEMY payload; CrowdStrike linked the backdoor's communications to VAPOR PANDA infrastructure.
Operators instructed ARTEX agents to identify Windows hosts without the CrowdStrike Falcon sensor. CrowdStrike recommends rotating exposed credentials, enforcing SAML validation, requiring IMDSv2, and hunting for ARTEX markers.

Article Details

Attack Vectors: VAPOR PANDA used ARTEX with DeepSeek and a second, unidentified commercial LLM to coordinate parallel intrusions, reconnaissance, and follow-on activity.
At a U.S.-based pharmaceutical organization, an agent used an unsigned SAML assertion and an XXE flaw to query the cloud Instance Metadata Service and obtain a cloud role capable of issuing administration commands.
At another U.S.-based pharmaceutical organization, agents deployed web shells, abused an unauthenticated orchestration service to obtain root access in a production container environment, read LAPS passwords, and abused resource-based constrained delegation to impersonate a privileged account.
Against a Greek government entity, an agent used authentication keys from a historical mail-server directory export to forge an administrator token and read mailboxes; VPN configurations from a user's sent mail and a VPN client key reportedly originating from an email leak were used to access the internal network.
The adversary conducted password spraying and credential scanning against multiple organizations and directed agents to inventory endpoint sensor coverage and focus activity on Windows hosts without the CrowdStrike Falcon sensor.
VAPOR PANDA deployed BLOODALCHEMY using a legitimate GameHook binary renamed svchost.exe to load a malicious DLL, which decrypted the payload file.
Defensive Notes: Rotate signing keys, preauthentication keys, and service credentials after suspected exposure, including keys present in historical backups and directory exports.
Enforce SAML signature validation, require IMDSv2, and restrict cloud roles' command-execution permissions to the minimum required instances.
Hunt for ARTEX markers, including command-line parameters containing artx or artex, artx-prefixed cloud roles, art18- administration-command comments, and the C:\ProgramData\artx5v\ directory.
Patch internet-facing appliances, particularly long-lived Linux-based servers, and ensure they run the latest available software and firmware.
Deploy a real-time EDR agent, such as the CrowdStrike Falcon sensor, across the environment, including on servers considered inaccessible from the public internet.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`nginxmysql[.]com`	Identified as a BLOODALCHEMY command-and-control domain.
DOMAIN	`sqlserver-sqlite[.]com`	Identified as a BLOODALCHEMY command-and-control domain.
DOMAIN	`www[.]ddduuuppp[.]com`	Identified as a BLOODALCHEMY command-and-control domain.
IPV4	`192[.]121[.]47[.]20`	Identified as the IP address of the BLOODALCHEMY C2 domain www[.]ddduuuppp[.]com.
IPV4	`45[.]153[.]126[.]223`	Identified as the IP address of the BLOODALCHEMY C2 domain nginxmysql[.]com.
IPV4	`89[.]46[.]234[.]50`	Identified as the IP address of the BLOODALCHEMY C2 domain sqlserver-sqlite[.]com.
SHA256	`364251838edfcf5ef1107fa692da3c5bd9a540482449f645992830134bf807ab`	Hash of the BLOODALCHEMY payload file, graphics-hook_config.bin.
SHA256	`3fb5a9fb3e2cb1d6208966bd4e55d10282d19c7250d827efa560463d60a12ee4`	Hash of the malicious BLOODALCHEMY loader DLL, graphics-hook-filter64.dll.
SHA256	`49fe70419fd19b81ca8d730a6ef7c1ec71b681d60b390761070d42686c7d2068`	Hash of the GameHook binary renamed svchost.exe and used to load the BLOODALCHEMY DLL.