CrowdStrike says a China-nexus espionage group used an open-source agentic framework, driven mostly by DeepSeek, to run parallel intrusions against more than 200 organisations in under a fortnight. The tradecraft the agents used is old; the scale one controller achieved is not, and UK defenders should plan for it.
What happened
On 29 October 2026 CrowdStrike published research attributing a fast-moving espionage campaign to VAPOR PANDA, a China-nexus adversary active since at least 2021. From 17 October, its OverWatch hunters saw a single controller running the ARTEX agent framework aim exploitation at victims spread across a minimum of 14 countries during an 11-day period, touching more than 200 distinct organisations.
The company confirmed hands-on post-exploitation at nine victims, where the group installed the BLOODALCHEMY backdoor and moved on to credential spraying, scanning and internal reconnaissance. At least 12 more organisations, among them US think tanks and government bodies in Europe, saw password spraying and credential scanning.
The victim list reads like an intelligence tasking order. Foreign ministries in two Latin American countries suffered extensive intrusions, with a third likely compromised. A Middle Eastern interior ministry was breached. One engagement concentrated on a single European state, hitting the head of state’s office, the prime minister’s office and the foreign ministry, plus bodies responsible for defence, justice, finance and intelligence. Nineteen US organisations in pharmaceuticals, semiconductors, defence, nuclear and finance were targeted, and telecoms operators were compromised in Belgium, the Philippines and the US. Press reports from NBC News and others rely entirely on CrowdStrike’s telemetry.
CrowdStrike is explicit that this is not the ARTEX activity Microsoft attributed to Storm-0940, and reads the overlap as a sign the framework is spreading across several China-linked groups. (The site has separately covered a criminal ARTEX case brought by Korean police; this is a different actor and a state mission.)
The technical picture
ARTEX is built around a lead agent that hands work to planner and worker agents, all sharing a graph of facts, findings and objectives. Each “task” is an engagement against a target, so one controller can hold many intrusions open at once. VAPOR PANDA ran it chiefly on DeepSeek, with a second subscription-based commercial model that CrowdStrike could not identify. In one intrusion alone, the planning agents processed roughly 1.4 billion input tokens.
This was not a fully autonomous attack. Recovered transcripts show a human giving orders in Chinese, flagged in the logs as human instructions and timestamped in China Standard Time, and stepping in at decision points. The operator told agents to write web shells, pull domain administrator passwords and map which hosts had endpoint sensors. At one pharmaceutical firm the instruction was, in CrowdStrike’s translation, to find Windows machines “without Falcon”, so follow-on work could focus on unmonitored hosts.
The techniques themselves would be familiar to any experienced tester. CrowdStrike describes agents that:
- combined a SAML weakness (an assertion accepted without a signature) with an XML external entity flaw to reach a cloud metadata service and obtain a highly privileged role;
- harvested LAPS-managed local admin passwords, then leaned on resource-based constrained delegation to act as a privileged user;
- reached root in a production container estate through an orchestration service exposed without authentication;
- forged a mail administrator token at a Greek government body using keys from a 2022 directory export that had likely not been rotated since, then used VPN settings found in sent mail to get inside.
Where a route failed, the agents switched to another, working web applications, cloud, containers, Active Directory, mail and VPN in parallel. On two victims the group deployed BLOODALCHEMY via DLL side-loading, hiding a legitimate GameHook binary under the name svchost.exe. Traffic ran over Tor, SOCKS proxies and a compromised relay, with tunnelling through Chisel and SoftEther.
Why it matters for UK organisations
CrowdStrike notes that VAPOR PANDA’s established targets since 2021 include government, think tank, energy and extractive organisations in the UK, as well as Europe, North America and Oceania. This campaign broadened that list into pharmaceuticals, semiconductors, nuclear and defence. The UK has significant firms in all of those sectors.
The deeper point is economic. Espionage has always been rate-limited by skilled operator hours. If one person can run dozens of engagements, each agent patiently trying every path, the number of organisations that are “worth a look” rises sharply. Mid-sized suppliers and consultancies that never expected state attention should assume they may now get it, if only as a stepping stone.
It also reframes stale secrets. The Greek intrusion turned on keys that had sat in an old export for years and a VPN client key from an earlier leak. Historic data dumps, old backups and forgotten exports are now cheap fuel for a machine that will try everything.
Expert view
In my experience, nothing in that list of techniques is exotic. Unsigned SAML assertions, XXE reaching instance metadata, readable LAPS attributes and delegation misconfigurations all turn up regularly in internal and cloud tests. What the agents bring is persistence and breadth: they do not get bored, they do not skip the dull check, and they chain small findings quickly.
That should change how we prioritise. Medium-rated findings that linger in remediation trackers are exactly what an automated attacker strings together. When we test, the path to domain or cloud administrator is rarely one critical flaw; it is three or four moderate ones lined up.
The sensor-hunting instruction is the other lesson. Attackers have always looked for the unwatched server. Coverage gaps are no longer just an audit finding; they are a targeting criterion built into the attacker’s workflow. Still, “AI-driven” does not mean unstoppable: a human was steering, the controller leaked its own tooling and transcripts, and threat hunters caught it.
What to do now
- Rotate long-lived secrets. Signing keys, Kerberos pre-authentication and service account credentials, mail server keys and VPN client keys, especially any that appear in old backups, directory exports or previously leaked data. This sits under Cyber Essentials user access control and secure configuration.
- Close the EDR gaps. Reconcile your asset inventory against sensor coverage, including servers you believe are unreachable from the internet. Treat any unmonitored Windows host in the domain as a priority (Cyber Essentials malware protection).
- Harden identity federation and cloud. Confirm every SAML service provider rejects unsigned assertions, enforce IMDSv2 on AWS workloads, and restrict which roles can issue commands to which instances.
- Review Active Directory exposure. Audit who can read LAPS passwords and where resource-based constrained delegation is configured; remove what is not needed.
- Patch and reduce exposure at the edge. Long-lived Linux appliances and orchestration interfaces should not be internet-facing without authentication (Cyber Essentials firewalls and security update management).
- Hunt now. Load CrowdStrike’s indicators, look for ARTEX markers and BLOODALCHEMY artefacts, and check for svchost.exe running from unusual paths.
Bottom line
VAPOR PANDA did not invent new attacks; it industrialised old ones. With a human steering and open-source agents doing the legwork, a single controller touched more than 200 organisations in 11 days. UK organisations in government, research, energy, pharmaceuticals and defence supply chains should rotate stale secrets, close sensor gaps and fix the medium-severity findings they have been living with, because an agent will find them.
Sources
- CrowdStrike: VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign
- NBC News: China-linked hackers used AI to target 200 organizations, CrowdStrike says
- TelcoNews UK: CrowdStrike uncovers China-linked AI cyber campaign
- Unite.AI: China-Nexus VAPOR PANDA Breached Nine of 200-Plus Targets With AI Agents
