Hunt: China-nexus VAPOR PANDA ran the open-source ARTEX agent framework on DeepSeek against 200+ organizations in 14 countries from Oct 17; look for artx/artex strings, C:\ProgramData\artx5v\ and BLOODALCHEMY C2

vendor threat intel (CrowdStrike OverWatch/Intelligence; Microsoft for North Korean ARTEX use)2026-10-30

Hunt: China-nexus VAPOR PANDA ran the open-source ARTEX agent framework on DeepSeek against 200+ organizations in 14 countries from Oct 17; look for artx/artex strings, C:\ProgramData\artx5v\ and BLOODALCHEMY C2

CrowdStrike says a single ARTEX controller it links to VAPOR PANDA targeted more than 200 organizations in at least 14 countries over 11 days starting Oct 17: foreign ministries in Latin America, Europe, Asia and the Middle East, US pharma, semiconductor, defense and think-tank organizations, and telecoms in the US, Belgium and the Philippines. Post-exploitation, including the BLOODALCHEMY backdoor, was confirmed at nine organizations. Recovered transcripts show a human operator steering the agents in Chinese at decision points; the agents ran mainly on DeepSeek plus an unidentified commercial model, using about 1.4 billion input tokens in one intrusion.

TTPs seen: unsigned SAML assertion plus XXE to reach cloud instance metadata and a role that could run commands on thousands of instances; JSP/PHP web shells; abuse of an unauthenticated orchestration service for container root; LAPS reads; resource-based constrained delegation; stolen VPN configs and leaked credentials; password spraying; asking agents to find hosts without EDR.
Hunt for: command lines containing artx or artex, cloud roles prefixed artx, admin-command comments starting art18-, the directory C:\ProgramData\artx5v\.
IOCs (defanged): BLOODALCHEMY C2 nginxmysql[.]com (45.153.126[.]223), sqlserver-sqlite[.]com (89.46.234[.]50), www[.]ddduuuppp[.]com (192.121.47[.]20); loader DLL graphics-hook-filter64.dll SHA-256 3fb5a9fb3e2cb1d6208966bd4e55d10282d19c7250d827efa560463d60a12ee4; payload graphics-hook_config.bin 364251838edfcf5ef1107fa692da3c5bd9a540482449f645992830134bf807ab; renamed svchost.exe 49fe70419fd19b81ca8d730a6ef7c1ec71b681d60b390761070d42686c7d2068.
Mitigate: enforce SAML signature validation, require IMDSv2, scope cloud command-execution roles, rotate keys found in backups or directory exports, patch internet-facing appliances, and get EDR onto servers assumed unreachable.

Separately, Microsoft said on Oct 29 that North Korean groups Onyx Sleet and Pearl Sleet have also used ARTEX since late October; it does not link them to VAPOR PANDA.

Sources: CrowdStrike: VAPOR PANDA uses AI-driven ARTEX to grow global espionage campaign · Microsoft Threat Intelligence: Tracking AI adoption in North Korean threat actor tradecraft (Oct 29)