CrowdStrike Says Vapor Panda Used AI-Powered ARTEX Against 200+ Organizations
Summary
CrowdStrike says Vapor Panda used AI-powered ARTEX against more than 200 organizations from Oct. 17, 2026. Post-exploitation was confirmed at nine, where attackers deployed BLOODALCHEMY; the article also describes other China-linked groups.
Key points
- CrowdStrike attributes ARTEX activity beginning Oct. 17, 2026, to China-linked Vapor Panda and says more than 200 organizations were targeted, including government, defense, semiconductor, think tank, and telecommunications entities.
- Post-exploitation activity was confirmed at nine organizations; the attackers deployed BLOODALCHEMY, described as a ShadowPad derivative, followed by credential spraying, network scanning, and reconnaissance.
- Vapor Panda also reportedly conducted password-spraying and credential-scanning activity against at least 12 additional organizations.
- ARTEX used DeepSeek and an unidentified subscription-based commercial LLM with planner and worker agents. A human operator directed tasks including writing web shells, extracting domain administrator passwords, and checking endpoint sensor coverage.
- CrowdStrike says recovered transcripts showed agents pursuing parallel paths across web applications, cloud services, containers, Active Directory, email, and VPN infrastructure, and switching approaches when a path failed. One intrusion consumed about 1.4 billion input tokens.
- Overcast Panda was linked to close-access intrusions in which FlowCloud was installed through direct physical access to devices while targets were in China; the backdoor supports persistent access, keylogging, screen capture, file collection, and credential harvesting.
- Titan Panda reportedly exploited a hard-coded IIS machine-key issue in Intapp Time Server to gain remote code execution at law firms, then used the in-memory IceGiant framework for reconnaissance, persistence, lateral movement, and data exfiltration.
Article Details
- Event Type
- Cyber intrusion activity using AI-powered penetration-testing automation, attributed by CrowdStrike to Vapor Panda, alongside reporting on other China-linked threat groups.
- Impact
- The activity reportedly targeted more than 200 organizations worldwide. Post-exploitation activity was confirmed at nine organizations, where the attacker deployed BLOODALCHEMY; password-spraying and credential-scanning activity was reported against at least 12 additional organizations. Other reported activity includes Overcast Panda's deployment of FlowCloud and Titan Panda's exploitation of Intapp Time Server to achieve remote code execution.
MITRE ATT&CK
T1046 · Network Service DiscoveryNetwork scanning was reported after BLOODALCHEMY deployment.T1110.003 · Password SprayingVapor Panda is reported to have conducted password-spraying activity against organizations.T1190 · Exploit Public-Facing ApplicationTitan Panda reportedly exploited a hard-coded IIS machine key vulnerability in Intapp Time Server to achieve remote code execution.T1505.003 · Web ShellA human operator directed ARTEX agents to write web shells.T1574.002 · DLL Side-LoadingFlowCloud is launched through DLL sideloading.
People
Threat Actors
Earth EstriesTrend Micro described a threat cluster that overlaps with Vapor Panda; the article does not state that the names are aliases.HOLLOW PANDANamed as one of four previously undocumented China-linked state-sponsored threat groups reported to have targeted sectors worldwide for intelligence gathering and intellectual property theft.OVERCAST PANDADescribed as a China-linked state-sponsored threat group. It has been linked to close-access intrusions in which FlowCloud was deployed on targets' devices through direct physical access while they were in China.TITAN PANDAReportedly targeted legal organizations by exploiting a hard-coded IIS machine key vulnerability in Intapp Time Server. The attacks led to IceGiant deployment for reconnaissance, persistence, lateral movement, and data exfiltration.VAPOR PANDACrowdStrike attributes the reported ARTEX-assisted intrusion activity to this China-based targeted intrusion adversary. The group is said to have targeted more than 200 organizations, with post-exploitation confirmed at nine.Veiled PandaNamed as one of four previously undocumented China-linked state-sponsored threat groups reported to have targeted sectors worldwide for intelligence gathering and intellectual property theft.VexatiousTemperIdentified by CrowdStrike as a previous moniker for Vapor Panda.
Malware
BloodAlchemyPost-exploitation activity has been confirmed at nine organizations, allowing the attacker to deploy BLOODALCHEMY, a derivative of ShadowPad, followed by credential spraying, network scanning, and reconnaissance.FlowCloudhas been linked to close access intrusions in which the adversary has deployed their proprietary FlowCloud backdoor on victims' devices via direct physical access when those targets were in the country.IceGiantThe attacks, first detected in April 2026, led to the deployment of an in-memory framework called IceGiant to carry out reconnaissance, persistence, lateral movement, and data exfiltration. The threat actor is assessedShadowPadPost-exploitation activity has been confirmed at nine organizations, allowing the attacker to deploy BLOODALCHEMY, a derivative of ShadowPad, followed by credential spraying, network scanning, and reconnaissance.
Products
DeepSeekCentral to the operation is the use of ARTEX with DeepSeek and an as-yet-unknown, subscription-based commercial large language model (LLM) to conduct the intrusions at scale, leveraging an army of planner and workerIntapp Time Serverby exploiting a hard-coded Internet Information Services (IIS) machine key vulnerability in Intapp Time Server to achieve remote code execution across law firms.Internet Information Services (IIS)the other hand, has been observed targeting legal billing software by exploiting a hard-coded Internet Information Services (IIS) machine key vulnerability in Intapp Time Server to achieve remote code execution across
Tools
Countries
ChinaThe activity has been attributed by CrowdStrike to a China-based "targeted intrusion adversary" it tracks under the moniker Vapor Panda (previously VexatiousTemper). First identified in February 2021, the hacking groupUnited StatesAmerica, Europe, Asia, and the Middle East; semiconductor, defense, and think tank organizations in the U.S.; and telecommunications providers in multiple regions.
Industries
Defenseworld, including foreign ministries in Latin America, Europe, Asia, and the Middle East; semiconductor, defense, and think tank organizations in the U.S.; and telecommunications providers in multiple regions.GovernmentVapor Panda is also said to have conducted password-spraying and credential-scanning activity against at least 12 additional organizations, including U.S.-based think tanks and government entities in Europe.LegalTitan Panda, on the other hand, has been observed targeting legal billing software by exploiting a hard-coded Internet Information Services (IIS) machine key vulnerability in Intapp Time Server to achieve remote codesemiconductoracross the world, including foreign ministries in Latin America, Europe, Asia, and the Middle East; semiconductor, defense, and think tank organizations in the U.S.; and telecommunications providers in multipleTelecommunicationsAsia, and the Middle East; semiconductor, defense, and think tank organizations in the U.S.; and telecommunications providers in multiple regions.Think tanksVapor Panda is also said to have conducted password-spraying and credential-scanning activity against at least 12 additional organizations, including U.S.-based think tanks and government entities in Europe.