“Find Windows machines in the domain without Falcon, based on the list of processes and folders. » The instruction is in Chinese, timestamped in Beijing time and preceded by a label, “human instruction”. It is aimed at AI agents released into the network of a global pharmaceutical group. Falcon is CrowdStrike’s security software. The agents had to identify the positions that it was not protecting, to concentrate the rest of the intrusion there.
CrowdStrike released these transcripts on October 29. They come from a command server linked to VAPOR PANDA, a spy group it links to China, which has intermittently exposed its tools, its target files and the exchanges of its agents. Since October 17, this server has run ARTEX, an open source framework that coordinates intrusion agents, against more than 200 organizations in at least 14 countries, according to the CrowdStrike report. The publisher is the only one documenting this campaign, and it sells the software that the attackers sought to avoid.
On October 21, Microsoft already attributed to Storm-0940, another group aligned with Beijing, a campaign carried out with the same tool against ConnectWise customers, as ActuIA had detailed. CrowdStrike specifies that the two operations are distinct. Two groups linked to China are therefore using the same tool, which CrowdStrike reads as a sign that it is probably quickly gaining popularity among them.
European ministries in the list
The clearest change concerns the targets. Since 2021, VAPOR PANDA has mainly targeted administrations, think tanks and the energy sector. This time, one of the operations entrusted to the agents targeted a single, unnamed European country: its Ministry of Foreign Affairs, its presidency, the services of its Prime Minister, and its defense, justice, finance and intelligence administrations. Another targeted 19 American pharmaceutical, semiconductor, defense, nuclear and financial organizations. Telecom operators have been compromised in the United States, Belgium and the Philippines.
The figure of 200 refers to targeted organizations, not victims. CrowdStrike confirms activity after intrusion in nine of them, where the group installed a backdoor known since 2023, BLOODALCHEMY, then launched reconnaissance and attacks on passwords. At least twelve others have suffered attempts on identifiers, including European administrations.
One operator, several intrusions at once
ARTEX organizes a main agent, planning agents and executing agents around a common basis of facts, discoveries and objectives. Humans only intervene at junctions. So far, CrowdStrike has seen AI agents assist one intrusion at a time. VAPOR PANDA carried out several in parallel, each agent changing tracks when one path failed: web applications, cloud services, containers, Active Directory, messaging, VPN.
The motors for this device are available over the counter. The group ran ARTEX primarily with DeepSeek, supplemented by a second business model accessible by subscription that CrowdStrike was unable to identify. In a single intrusion, planner agents consumed on the order of 1.4 billion input tokens. CrowdStrike sees this as a deliberate choice: building a tool chain that does not depend on any model provider, from open source components and commercial subscriptions. A state espionage group is equipping itself here like a start-up.
Old flaws, exploited more quickly
The agents didn’t invent anything. At a US pharmaceutical company, they chained together an unsigned SAML assertion and an XML flaw to query the cloud metadata service, extract a role capable of controlling thousands of instances, and then trace it back to a company administrator account. Against a Greek administration, the operator provided them with a directory export from 2022 whose authentication keys had probably not been changed since. Agents used it to forge an administrator token and read mailboxes. A VPN client key from, according to the operator, an email leak from May 2024 allowed them to reach the internal network.
This is the most useful lesson of the report, and the least spectacular. A leak two or four years old, which a small group would not have had time to exploit everywhere, becomes profitable when agents test it on dozens of targets at once. CrowdStrike says it in its own way: a single operator applies more techniques to more targets than by operating by hand.
What CrowdStrike asks to check
The report’s recommendations first target what the agents exploited:
- change signing, pre-authentication, and service account keys after any data exposure, including data lying dormant in backups or directory exports;
- enforce SAML signature validation, require IMDSv2 on AWS, and reduce command execution rights for cloud roles;
- look for traces of ARTEX: “artx” or “artex” strings in command line, cloud roles prefixed “artx”, “art18-” comments in administration commands, folder C:ProgramDataartx5v;
- update equipment exposed to the internet, in particular old Linux servers.
CrowdStrike considers it very likely that groups linked to China will continue to adopt this type of tool in the next twelve months. The VAPOR PANDA server showed what it was preparing: target files already ready for foreign ministries in Central America and Asia. CrowdStrike does not say whether these operations have been launched.
Instructions translated from Chinese by ActuIA, based on the English translation published by CrowdStrike.
Our articles will be prioritized in Google’s “Featured” section.
