Cutsign — VAPOR PANDA used ARTEX agentic AI framework against 200+ orgs; post-exploitation confirmed at nine

AI-generated verdict card, published automatically by the pipeline on day one because the brief rated the story P1. Version 2, as of 2026-10-30; hype score 7 (below the usual publish bar: early read from few sources, revised as the story develops). Written by a model from the stored public sources and not reviewed by a person; re-issued in place when the evidence changes (the URL stays). The detection-coverage table below is checked automatically from public sources and re-checked daily. Supersedes version 1. All cards

VAPOR PANDA used ARTEX agentic AI framework against 200+ orgs; post-exploitation confirmed at nine

Hunt + hardenP1confidence: highP1 +2deep read +1primary source +1actor named +1material development on watch +2P1: card on day one (score below the publish bar; revised as the story develops)

CrowdStrike reports a China-nexus espionage campaign that used the ARTEX agentic AI framework, with post-exploitation confirmed at nine organizations, including US financial-sector targets. Today: run the ARTEX, sideloading and IOC hunts, and confirm SAML signature validation, IMDSv2 and cloud command-execution permissions.

Triage: The vendor confirms post-exploitation at nine organizations, including US financial-sector targets, and publishes concrete huntable markers [S1].

The core claims come from CrowdStrike's own research post, which is the primary source [S1]. It is still the only source in the thread, so details rest on one vendor.

Changed since version 1

Added graphics-hook-filter64.dll to the IOC hunt, Scope and Eradicate as the sideloaded DLL name [S1].
Added that ARTEX uses DeepSeek plus a commercial LLM [S1].
Added the PDB path D:\ProjectX\Merman_New\ as a string check in Verify [S1 evidence sample].
Added Eradicate items, Re-enter triggers and coverage checks [S1].
Added a debrief gap: S1 does not say whether BLOODALCHEMY was deployed at all nine organizations, against the story headline's wording.

What happened

CrowdStrike attributes the campaign to China-nexus VAPOR PANDA. The actor used ARTEX, an agentic AI framework built on DeepSeek plus a commercial LLM, against 200+ organizations in 14+ countries from Oct 17, 2026 [S1].
Post-exploitation is confirmed at nine organizations, including US financial-sector targets. Password spraying and credential scanning hit at least 12 more [S1].
Initial and cloud access chained an unsigned SAML assertion with an XXE flaw to query cloud IMDS. Other access came from JSP/PHP web shells, forged mail admin tokens, and VPN configs and a client key recovered from sent mail [S1].
In AD, the actor read LAPS passwords and abused RBCD to impersonate a privileged account. It used tasklist and folder listings to find hosts without Falcon, and tunneled traffic over Chisel and SoftEther [S1].
BLOODALCHEMY was sideloaded by a legitimate GameHook binary, renamed svchost.exe, loading graphics-hook-filter64.dll [S1].

Timeline

2026-10-17	Campaign activity begins, per CrowdStrike S1
2026-10-30	Card revised with the sideloaded DLL name, the ARTEX model details and a PDB path sample S1

Detect

ARTEX command-line and path markers · EDR process events / Sysmon EID 1, Windows 4688

index=* (CommandLine="*artx*" OR CommandLine="*artex*" OR CommandLine="*art18-*" OR CommandLine="*ProgramData\\artx5v*" OR TargetFilename="*ProgramData\\artx5v*") | stats count min(_time) as first max(_time) as last values(CommandLine) as cmd by host, User, Image

FROM logs-* | WHERE process.command_line LIKE "*artx*" OR process.command_line LIKE "*artex*" OR process.command_line LIKE "*art18-*" OR process.command_line LIKE "*ProgramData\\\\artx5v*" OR file.path LIKE "*ProgramData\\\\artx5v*" | STATS count = COUNT(*), first = MIN(@timestamp), last = MAX(@timestamp), cmd = VALUES(process.command_line) BY host.name, user.name, process.executable

A hit means: A process or file event carries a marker CrowdStrike ties to ARTEX tooling [S1]. Treat it as a candidate intrusion until verified.

Renamed svchost.exe loading graphics-hook DLL (BLOODALCHEMY sideload) · Sysmon EID 7 image load / EDR module load

index=* EventCode=7 ImageLoaded="*graphics-hook*" Image="*\\svchost.exe" NOT (Image="C:\\Windows\\System32\\*" OR Image="C:\\Windows\\SysWOW64\\*") | stats count values(ImageLoaded) as dll values(Hashes) as hashes by host, Image

FROM logs-* | WHERE event.code == "7" AND file.path LIKE "*graphics-hook*" AND process.executable LIKE "*\\\\svchost.exe" AND NOT (process.executable LIKE "C:\\\\Windows\\\\System32\\\\*" OR process.executable LIKE "C:\\\\Windows\\\\SysWOW64\\\\*") | STATS count = COUNT(*), dll = VALUES(file.path), hashes = VALUES(file.hash.sha256) BY host.name, process.executable

A hit means: An svchost.exe outside the system directories is loading a graphics-hook DLL. This matches the BLOODALCHEMY sideload via graphics-hook-filter64.dll [S1].

ARTEX markers in cloud command execution and roles · Cloud audit logs (e.g. CloudTrail SSM SendCommand, IAM role events)

index=* ((eventName=SendCommand "art18-") OR (eventName IN (CreateRole, AssumeRole, AttachRolePolicy, PutRolePolicy) "artx")) | stats count min(_time) as first values(eventName) as events values(sourceIPAddress) as src by userIdentity.arn, awsRegion

FROM logs-* | EVAL raw = TO_STRING(event.original) | WHERE (event.action == "SendCommand" AND raw LIKE "*art18-*") OR (event.action IN ("CreateRole", "AssumeRole", "AttachRolePolicy", "PutRolePolicy") AND raw LIKE "*artx*") | STATS count = COUNT(*), first = MIN(@timestamp), events = VALUES(event.action), src = VALUES(source.ip) BY aws.cloudtrail.user_identity.arn, cloud.region

A hit means: Cloud command execution carries art18- comments, or an artx-prefixed role exists. S1 attributes both to ARTEX operators.

VAPOR PANDA infrastructure and file IOCs · DNS, proxy, firewall, EDR file/hash events

index=* ("nginxmysql.com" OR "sqlserver-sqlite.com" OR "ddduuuppp.com" OR "45.153.126.223" OR "89.46.234.50" OR "192.121.47.20" OR "49fe70419fd19b81ca8d730a6ef7c1ec71b681d60b390761070d42686c7d2068" OR "3fb5a9fb3e2cb1d6208966bd4e55d10282d19c7250d827efa560463d60a12ee4" OR "364251838edfcf5ef1107fa692da3c5bd9a540482449f645992830134bf807ab" OR "graphics-hook-filter64.dll" OR "graphics-hook_config.bin") | stats count min(_time) as first max(_time) as last by sourcetype, host

A hit means: A host contacted, or holds, infrastructure or files CrowdStrike lists for this campaign [S1]. Look back to at least Oct 17, 2026.

Verify

Sideload hits: confirm the svchost.exe path, signer and original file name. A genuine svchost.exe runs only from System32 or SysWOW64. A renamed GameHook binary shows a different original name or signer. Check the DLL hash against the S1 SHA-256 list.
Suspect binaries: search strings for the PDB path D:\ProjectX\Merman_New\ from the S1 samples. S1 does not tie this path to a specific file.
ARTEX strings: review the full command line, parent process and user. Short substrings such as 'artx' can match unrelated tools or filenames.
Cloud hits: check whether a known admin pipeline created the role or command, and compare the source IP to the S1 IOCs.
tasklist and folder listings are routine admin activity. They matter only alongside other markers or from unexpected accounts.
Password spraying: look for many accounts, few attempts each, from shared sources. A misconfigured service account usually shows many failures on one account.

Scope

Affected

Targeted: 200+ organizations in 14+ countries; post-exploitation confirmed at nine, including US financial-sector organizations [S1]
Password spraying and credential scanning against at least 12 additional organizations [S1]

Only if

None stated by the sources.

Not affected if

None stated by the sources.

Enumerate

SAML service providers that accept assertions, and whether each enforces signature validation [S1]
Internet-facing apps that parse XML (XXE exposure) on cloud instances, and whether those instances require IMDSv2 [S1]
Identities holding cloud command-execution permissions (e.g. SSM SendCommand), plus any artx-prefixed roles [S1]
Accounts with read rights on LAPS passwords; computer objects with msDS-AllowedToActOnBehalfOfOtherIdentity set [S1]
VPN client keys and configs ever sent by email; VPN logins since Oct 17, 2026 [S1]
Web server directories with unexpected JSP/PHP files [S1]

Contain

Capture memory and disk images before isolating any host with a hit. Reimaging destroys evidence and cannot be undone.
Block the S1 domains and IPs at DNS, proxy and firewall. Block Chisel and SoftEther tunnels at egress [S1].
Revoke mail admin tokens, VPN client keys and any VPN configs found in mail. Revocation cannot be reversed and may disrupt users [S1].
Record unauthorized RBCD entries, then remove them. Restrict cloud command-execution permissions [S1].
Rotate LAPS passwords on exposed hosts and cloud keys reachable via IMDS. Old credentials cannot be restored, so check dependent services first [S1].
Enforce SAML signature validation and require IMDSv2 [S1].

Eradicate

Remove JSP/PHP web shells and fix the XXE-exposed application [S1].
Remove the renamed GameHook svchost.exe, graphics-hook-filter64.dll, graphics-hook_config.bin and C:\ProgramData\artx5v\ [S1].
Delete artx-prefixed cloud roles and unauthorized RBCD delegations [S1].
Remove Chisel and SoftEther binaries and services [S1].

Recover

Before restoring a host or tenant, re-run all four hunts and confirm SAML validation and IMDSv2 are enforced [S1].
Confirm no unauthorized RBCD, LAPS-read rights or cloud roles remain.
Afterwards, monitor LAPS reads, 5136 RBCD changes, S4U 4769 events, VPN logins, password-spray patterns and cloud SendCommand activity.

Re-enter the loop when

CrowdStrike updates S1 with new IOCs, hashes or ARTEX markers.
A CVE or named product is published for the SAML or XXE flaw.
Any hunt returns a verified hit.
Another vendor ties ARTEX activity to a different actor or a supply-chain vector that touches your vendors.
The victim count or sector list in S1 widens.

Debrief

Record hunt coverage dates, each hit and its verification outcome, and the credentials and keys rotated.
Record which log sources were missing: Sysmon EID 7, 4662, 5136, cloud audit logs, VPN.
Gap: S1 does not name the SAML or XXE-affected product, or a CVE.
Gap: S1 does not identify the mail platform or VPN product abused.
Gap: the input does not map the hashes or the Merman_New PDB path to specific files.
Gap: S1 does not say whether BLOODALCHEMY was deployed at all nine confirmed organizations.

Detection coverage — checked automatically

Category	Source	Status
Vendor	Impacted vendor / CERT advisory	published — primary source among the thread's sources: https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/
Government	CISA KEV	not checkable — no CVE: the catalog is keyed by CVE
EDR / endpoint VM	CrowdStrike blog	nothing found — no post names it among the feed's 10 newest items
EDR / endpoint VM	Microsoft Security blog	published — ARTEX abuse expands as cybercriminals target financial sector · Threat actors use agentic AI tooling to find and abuse exposed secrets (names ARTEX in the title; the feed text carries no CVE id)
EDR / endpoint VM	SentinelOne blog	published — The Good, the Bad and the Ugly in Cybersecurity - Week 43 (2026) (names the campaign in the title; the feed text carries no CVE id)
EDR / endpoint VM	SentinelOne Labs	nothing found — no post names it among the feed's 10 newest items
WAF / edge	Akamai blog	published — What ARTEX Reveals About Overlooked Attack Surfaces (names ARTEX in the title; the feed text carries no CVE id)
WAF / edge	Cloudflare WAF managed-ruleset changelog	nothing found — no post names it among the feed's 139 newest items
Cloud / container	Wiz blog	published — ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors (names ARTEX in the title; the feed text carries no CVE id)
IDS / research	Cisco Talos blog	nothing found — no post names it among the feed's 15 newest items
Detection content	Elastic detection rules	published — 1 file names VAPOR: rules/integrations/anthropic/command_and_control_anthropic_suspicious_user_agent.toml
Detection content	Elastic Security Labs	nothing found — no post names it among the feed's 102 newest items
Detection content	SigmaHQ rules	nothing found — no rule file names BLOODALCHEMY / VAPOR PANDA / VAPOR
Detection content	Splunk ESCU	nothing found — no rule file names BLOODALCHEMY / VAPOR PANDA / VAPOR
MSSP / IR firms	Arctic Wolf blog	nothing found — no post names it among the feed's 10 newest items
MSSP / IR firms	Huntress blog	nothing found — no post names it among the feed's 754 newest items
MSSP / IR firms	Rapid7 blog	nothing found — no post names it among the feed's 20 newest items
MSSP / IR firms	Sophos threat research	published — ARTEX: Attackers apply agentic AI (names ARTEX in the title; the feed text carries no CVE id)
Research	Unit 42	nothing found — no post names it among the feed's 15 newest items

Checked automatically 2026-11-10 21:16Z from public sources: 7 published, 11 nothing found, 1 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

What a person would still look up (6)

EDR / endpoint	Check whether your EDR alerts on a renamed signed binary posing as svchost.exe outside System32, and on the S1 hashes.
EDR / endpoint	Check whether Chisel and SoftEther execution is detected or blocked.
Identity / AD	Check whether your identity tooling alerts on LAPS password reads, RBCD attribute writes and S4U abuse.
IdP / SSO	Check whether unsigned SAML assertions are rejected and logged, and whether password-spray detection is on.
Cloud security	Check for IMDSv1 exposure, SSM SendCommand use by unexpected identities, and new artx-prefixed roles.
WAF / edge	Check whether XXE payloads to XML-parsing endpoints are inspected, and web shell uploads flagged.

Exposure queries — generated automatically

No CVE in this campaign: nothing an internet scanner keys on. Scope by product in your own tool.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-10 21:16Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

Today's story headline says BLOODALCHEMY was deployed at nine organizations. The summary says only that post-exploitation was confirmed at nine. The card keeps the narrower claim.
Other vendor posts in the pipeline's coverage list (Microsoft, Wiz) reference ARTEX and Storm-0940. The relationship to VAPOR PANDA is not in S1 and is unverified.
Which SAML service provider and XML parser were abused? Is there a CVE?
Which financial-sector organizations or sub-sectors were hit, and was any data confirmed exfiltrated?

Sources

[S1] https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/ · crowdstrike.com

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically; a dismissed draft unpublishes it.