Cutsign — draft: VAPOR PANDA used ARTEX agentic AI framework against 200+ orgs; post-exploitation confirmed at nine

AI-generated draft, unreviewed. Version 1, written by a model from the stored public sources on 2026-10-30; hype score 5. It is regenerated when the evidence changes and is published as a verdict card under /cards/ once it crosses the publish bar. Status: superseded.

VAPOR PANDA used ARTEX agentic AI framework against 200+ orgs; post-exploitation confirmed at nine

Hunt + hardenP1confidence: mediumP1 +2deep read +1primary source +1actor named +1P1: card on day one (score below the publish bar; revised as the story develops)

CrowdStrike reports a China-nexus espionage campaign using the ARTEX agentic AI framework, with confirmed post-exploitation at nine organizations, including US financial-sector targets. Today: run the ARTEX, sideloading and IOC hunts, and confirm SAML signature validation, IMDSv2 and cloud command-execution permissions.

Triage: The vendor confirms post-exploitation at nine organizations, including US financial-sector targets, and gives concrete huntable markers [S1].

A single vendor primary source [S1] with first-hand incident detail. No independent corroboration in the input yet.

What happened

VAPOR PANDA used ARTEX, an agentic AI framework built on DeepSeek plus a commercial LLM, against 200+ organizations in 14+ countries from Oct 17, 2026 [S1].
Post-exploitation is confirmed at nine organizations, including US financial-sector targets [S1].
Initial and cloud access came from an unsigned SAML assertion chained with an XXE flaw to query cloud IMDS. Other access came from VPN configs and a client key recovered from sent mail, and from password spraying against 12+ further organizations [S1].
On-network activity included JSP/PHP web shells, LAPS password reads, RBCD impersonation of a privileged account, forged mail admin tokens, and Chisel/SoftEther tunnels. The actor also ran tasklist checks to find hosts without Falcon [S1].
BLOODALCHEMY was sideloaded by a GameHook binary renamed svchost.exe, which loaded graphics-hook-filter64.dll [S1].

Timeline

2026-10-17	Campaign activity begins per CrowdStrike. S1
2026-10-30	CrowdStrike publishes the VAPOR PANDA / ARTEX report with IOCs and hunting guidance. S1

Detect

ARTEX command-line and path markers · EDR process events / Sysmon EID 1, Windows 4688

index=* (CommandLine="*artx*" OR CommandLine="*artex*" OR CommandLine="*art18-*" OR CommandLine="*ProgramData\\artx5v*" OR TargetFilename="*ProgramData\\artx5v*") | stats count min(_time) as first max(_time) as last values(CommandLine) as cmd by host, User, Image

A hit means: A process or file event carries a marker CrowdStrike ties to ARTEX tooling [S1]. Treat it as a candidate intrusion until verified.

Renamed svchost.exe loading graphics-hook DLL (BLOODALCHEMY sideload) · Sysmon EID 7 image load / EDR module load

index=* EventCode=7 ImageLoaded="*graphics-hook*" Image="*\\svchost.exe" NOT (Image="C:\\Windows\\System32\\*" OR Image="C:\\Windows\\SysWOW64\\*") | stats count values(ImageLoaded) as dll values(Hashes) as hashes by host, Image

A hit means: An svchost.exe outside the system directories is loading a graphics-hook DLL. This matches the BLOODALCHEMY sideload chain [S1].

ARTEX markers in cloud command execution and roles · Cloud audit logs (e.g. CloudTrail SSM SendCommand, IAM role events)

index=* ((eventName=SendCommand "art18-") OR (eventName IN (CreateRole, AssumeRole, AttachRolePolicy, PutRolePolicy) "artx")) | stats count min(_time) as first values(eventName) as events values(sourceIPAddress) as src by userIdentity.arn, awsRegion

A hit means: Cloud command execution with art18- comments, or artx-prefixed roles. S1 attributes both to ARTEX operators.

VAPOR PANDA infrastructure and file IOCs · DNS, proxy, firewall, EDR file/hash events

index=* ("nginxmysql.com" OR "sqlserver-sqlite.com" OR "ddduuuppp.com" OR "45.153.126.223" OR "89.46.234.50" OR "192.121.47.20" OR "49fe70419fd19b81ca8d730a6ef7c1ec71b681d60b390761070d42686c7d2068" OR "3fb5a9fb3e2cb1d6208966bd4e55d10282d19c7250d827efa560463d60a12ee4" OR "364251838edfcf5ef1107fa692da3c5bd9a540482449f645992830134bf807ab" OR "graphics-hook_config.bin") | stats count min(_time) as first max(_time) as last by sourcetype, host

A hit means: Contact with, or presence of, infrastructure or files listed by CrowdStrike for this campaign [S1]. Look back to at least Oct 17, 2026.

Verify

For the sideload hunt, confirm the svchost.exe path, signer and hash, and check the loaded DLL hash against the S1 SHA-256 list. A genuine svchost.exe runs only from system directories.
For ARTEX strings, review the full command line, parent process and user. Short substrings such as 'artx' can match unrelated tools or filenames.
For cloud hits, confirm whether the role or command was created by a known admin pipeline. Check the source IP against S1 IOCs.
tasklist and folder listings are routine admin activity. They are only notable alongside other markers or from unexpected accounts.
For password spraying, separate it from misconfigured service accounts: look for many accounts, few attempts each, and from shared sources.
For LAPS reads (4662 on ms-Mcs-AdmPwd) and RBCD changes (5136 on msDS-AllowedToActOnBehalfOfOtherIdentity), compare the reading or writing account to the authorized admin list.

Scope

Affected

Targeted: 200+ organizations in 14+ countries; post-exploitation confirmed at nine, including US financial-sector organizations [S1]
Password spraying and credential scanning against at least 12 additional organizations [S1]

Only if

None stated by the sources.

Not affected if

None stated by the sources.

Enumerate

SAML service providers that accept assertions, and whether each enforces signature validation [S1]
Internet-facing apps that parse XML (XXE exposure) on cloud instances, and whether those instances require IMDSv2 [S1]
Identities holding cloud command-execution permissions (e.g. SSM SendCommand), plus any artx-prefixed roles [S1]
Accounts with read rights on LAPS passwords; computer objects with msDS-AllowedToActOnBehalfOfOtherIdentity set [S1]
VPN client keys and configs ever sent by email; VPN logins since Oct 17, 2026 [S1]
Web server directories for unexpected JSP/PHP files [S1]

Contain

Before isolating any host with a hit, capture memory and disk images. Reimaging destroys evidence and cannot be undone.
Block the S1 domains and IPs at DNS, proxy and firewall. Block Chisel/SoftEther tunnels at egress [S1].
Revoke mail admin tokens, VPN client keys and VPN configs found in mail. Revocation is not reversible and may disrupt users [S1].
Record, then remove, unauthorized RBCD entries. Restrict cloud command-execution permissions [S1].
Rotate LAPS passwords on exposed hosts, and rotate cloud keys reachable via IMDS. Old credentials cannot be restored, so check dependent services first [S1].
Enforce SAML signature validation and require IMDSv2 [S1].

Eradicate

Remove the JSP/PHP web shells [S1].
Remove the BLOODALCHEMY sideload set: renamed svchost.exe, graphics-hook-filter64.dll and graphics-hook_config.bin [S1].
Remove C:\ProgramData\artx5v\ and any artx-prefixed cloud roles [S1].
Remove Chisel/SoftEther tooling and any associated services [S1].
Fix the root causes: unsigned SAML acceptance, the XXE flaw, IMDSv1 exposure, and VPN secrets stored in mail [S1].

Recover

Before restoring a host or tenant, re-run all four hunts and confirm SAML validation and IMDSv2 are enforced.
Confirm no unauthorized RBCD, LAPS-read rights or cloud roles remain.
Afterwards, monitor LAPS reads, 5136 RBCD changes, S4U 4769 events, VPN logins, password-spray patterns and cloud SendCommand activity.

Re-enter the loop when

CrowdStrike or another vendor publishes new IOCs, hashes or ARTEX markers.
The SAML/XXE-affected product or a CVE is named.
The victim count, sectors or countries widen beyond S1.
A hunt hit appears on a host or tenant outside the first scope.
A CERT or government advisory confirms, contradicts or extends S1.

Debrief

Record hunt coverage dates, each hit and its verification outcome, and the credentials and keys rotated.
Record which log sources were missing: Sysmon EID 7, 4662, 5136, cloud audit logs, VPN.
Gap: S1 does not name the SAML or XXE-affected product or a CVE.
Gap: S1 does not identify the mail platform or the VPN product abused.
Gap: S1 does not map the hashes to specific files, as far as the input shows.

Detection coverage — checked automatically

Category	Source	Status
Vendor	Impacted vendor / CERT advisory	published — primary source among the thread's sources: https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/
Government	CISA KEV	not checkable — no CVE: the catalog is keyed by CVE
EDR / endpoint VM	CrowdStrike blog	published — VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign (names VAPOR PANDA / VAPOR / PANDA / ARTEX in the title; the feed text carries no CVE id)
EDR / endpoint VM	Microsoft Security blog	published — AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise · Tracking AI adoption in North Korean threat actor tradecraft (names ARTEX in the title; the feed text carries no CVE id)
EDR / endpoint VM	SentinelOne blog	published — The Good, the Bad and the Ugly in Cybersecurity - Week 43 (2026) (names the campaign in the title; the feed text carries no CVE id)
EDR / endpoint VM	SentinelOne Labs	nothing found — no post names it among the feed's 10 newest items
WAF / edge	Akamai blog	published — What ARTEX Reveals About Overlooked Attack Surfaces (names ARTEX in the title; the feed text carries no CVE id)
WAF / edge	Cloudflare WAF managed-ruleset changelog	nothing found — no post names it among the feed's 133 newest items
Cloud / container	Wiz blog	published — ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors (names ARTEX in the title; the feed text carries no CVE id)
IDS / research	Cisco Talos blog	nothing found — no post names it among the feed's 15 newest items
Detection content	Elastic detection rules	published — 1 file names VAPOR: rules/integrations/anthropic/command_and_control_anthropic_suspicious_user_agent.toml
Detection content	Elastic Security Labs	nothing found — no post names it among the feed's 102 newest items
Detection content	SigmaHQ rules	nothing found — no rule file names BLOODALCHEMY / VAPOR PANDA / VAPOR
Detection content	Splunk ESCU	nothing found — no rule file names BLOODALCHEMY / VAPOR PANDA / VAPOR
MSSP / IR firms	Arctic Wolf blog	nothing found — no post names it among the feed's 10 newest items
MSSP / IR firms	Huntress blog	nothing found — no post names it among the feed's 746 newest items
MSSP / IR firms	Rapid7 blog	nothing found — no post names it among the feed's 20 newest items
MSSP / IR firms	Sophos threat research	nothing found — no post names it among the feed's 15 newest items
Research	Unit 42	nothing found — no post names it among the feed's 15 newest items

Checked automatically 2026-10-30 15:13Z from public sources: 7 published, 11 nothing found, 1 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

What a person would still look up (6)

EDR	Check whether the agent records module loads and command lines that would surface the renamed svchost.exe sideload and ARTEX strings.
SIEM	Confirm Sysmon EID 7, Windows 4662/5136/4769 and cloud audit logs are ingested and retained back to Oct 17, 2026.
Cloud security posture	Check whether it flags IMDSv1, broad command-execution permissions and unusual role names.
Identity provider / SAML	Verify signature enforcement settings and spray-detection logic with the vendor.
DNS / proxy / firewall	Confirm the S1 domains and IPs are blockable and that historic lookups are queryable.
Email security	Check for the ability to find VPN configs and keys in sent mail, and to audit admin token issuance.

Exposure queries — generated automatically

No CVE in this campaign: nothing an internet scanner keys on. Scope by product in your own tool.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-10-30 15:13Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

Is the core claim corroborated by any source beyond CrowdStrike?
Which product and CVE carried the XXE flaw, and which SAML implementation accepted unsigned assertions?
Which commercial LLM did ARTEX use, and does that matter for detection?
Could legitimate game-capture or overlay software that ships graphics-hook DLLs produce false positives? S1 does not say.
Which file does each SHA-256 correspond to?
What is the significance of the PDB path D:\ProjectX\Merman_New\, and is it reliable as a marker?
Did activity predate Oct 17, 2026?

Sources

[S1] https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/ · crowdstrike.com

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically once it crosses the publish bar.