According to CrowdStrike, the espionage group VAPOR PANDA, which it attributes to China, has directed ARTEK, an open-source framework coordinating intrusion agents, against over 200 organizations in at least 14 countries since October 17. Nine have suffered a confirmed intrusion. This is the second China-linked group to use this tool, after Storm-0940.
On October 29, CrowdStrike published transcripts of these operations, sourced from a command server linked to VAPOR PANDA. This server intermittently exposed its tools, target files, and agent communications. Notably, it contained an instruction in Chinese, timestamped to Beijing time and preceded by the label ‘human instruction’: ‘Find Windows machines without Falcon in the domain, based on the process list and folders.’ Falcon is CrowdStrike’s security software. The instruction was directed at AI agents deployed in the network of a global pharmaceutical group, tasked with identifying workstations not protected by this software to focus subsequent intrusion efforts. It was translated by ActuIA from the English version published by CrowdStrike.
On October 21, Microsoft had already attributed to Storm-0940, another group aligned with Beijing, a campaign conducted with the same tool against ConnectWise customers. CrowdStrike clarifies that the two operations are distinct and sees this as a sign that the tool is likely gaining popularity among China-linked groups. For now, it is the only source documenting this campaign, and the vendor itself sells the software the attackers were trying to avoid.
European Ministries on the List
The most notable change concerns the targets. Since 2021, VAPOR PANDA primarily targeted government agencies, think tanks, and the energy sector. One operation assigned to the agents targeted a single unnamed European country: its Ministry of Foreign Affairs, its presidency, its Prime Minister’s services, and its defense, justice, finance, and intelligence administrations. Another targeted 19 US organizations in pharmaceuticals, semiconductors, defense, nuclear, and finance. Telecom operators were compromised in the United States, Belgium, and the Philippines.
The figure of 200 refers to targeted organizations, not victims. CrowdStrike confirms post-intrusion activity in nine of them, where the group installed a backdoor known since 2023, BLOODALCHEMY, before launching reconnaissance actions and password attacks. At least twelve others suffered credential attempts, including European administrations.
One Operator, Multiple Simultaneous Intrusions
ARTEK organizes a main agent, planner agents, and executor agents, which share a common base of facts, discoveries, and objectives. Human intervention occurs only at decision points. Until now, CrowdStrike had observed AI agents assisting one intrusion at a time. VAPOR PANDA conducted several in parallel, with each agent switching tracks when one avenue failed, whether it involved web applications, cloud services, containers, Active Directory, email, or VPN.
The group ran ARTEK primarily with DeepSeek, supplemented by a second commercial model accessible by subscription, which CrowdStrike could not identify. In a single intrusion, the planner agents consumed approximately 1.4 billion input tokens, tokens being the units of text a model processes. According to CrowdStrike, this choice is deliberate: it aims for a toolchain independent of any specific model provider, built from open-source components and commercial subscriptions. The report describes the engines of this setup as being commercially available.
Old Vulnerabilities, Exploited Faster
The agents primarily exploited already known vulnerabilities. In a US pharmaceutical laboratory, they chained an unsigned SAML assertion, an authentication protocol, and an XML vulnerability to obtain an enterprise administrator account. Against a Greek administration, the operator provided them with a 2022 directory export whose authentication keys had likely not been changed since. A VPN client key, which according to the operator came from a May 2024 email leak, also allowed them to reach an internal network.
CrowdStrike recommends changing keys after any data exposure, including those stored in backups or directory exports, validating SAML signatures, and enforcing IMDSv2 on AWS. It also advises looking for traces of ARTEK, such as ‘artx’ or ‘artek’ command-line strings, and updating internet-exposed equipment, particularly old Linux servers. The CrowdStrike report considers it highly likely that China-linked groups will continue to adopt this type of tool over the next twelve months. The server also revealed target files prepared for Ministries of Foreign Affairs in Central America and Asia, though CrowdStrike does not know if these operations were launched.
