China-linked hackers' ARTEX AI agents targeted 200+ organisations; here's how to check your clients' networks for the backdoor they left.
A China-linked crew handed much of its break-in work to AI agents, and drug makers, ministries and telecom carriers landed on its target list. On 29 October 2026, CrowdStrike reported that the group, which it calls VAPOR PANDA, pointed the ARTEX agent framework at more than 200 organisations in at least 14 countries. Check every client's logs, hosts, cloud accounts and domain today.
VAPOR PANDA is a China-nexus intrusion group that, per CrowdStrike, ran ARTEX, a framework where a main AI agent directs planner and worker agents, mostly on the DeepSeek AI model. CrowdStrike says the agents went after web apps and single sign-on, cloud and mail servers and Windows domains, planting a backdoor called BLOODALCHEMY at some victims. Targets include pharmaceutical and defence firms, foreign ministries and telecom carriers.
CrowdStrike confirms post-exploitation at nine organisations; CyberScoop reports CrowdStrike told it about 70% of targets were compromised or likely so. Treat any client in these sectors as possibly hit.
This was an intrusion, not a pentest: a pentest is authorised, scoped and reported to the owner.
CrowdStrike dates the campaign from 17 October 2026 but tracked the group earlier, so search the oldest logs in the client's SIEM (central log store); on-device logs cover far less, and a clean result there does not rule out an earlier break-in. Push the PowerShell steps to Windows machines through the client's RMM (remote management) tool.
Preserve evidence. Copy the log archive and the Windows Security log, then hash both. Pass: both hash files list the copied files.
# log server; replace /var/log/remote with where the client's DNS, proxy and firewall logs land
D=/srv/ir/vapor-panda
sudo mkdir -p "$D"
sudo cp -a /var/log/remote "$D"/
sudo find "$D" -type f -exec sha256sum {} + | sudo tee "$D.sha256"
# Windows host, admin PowerShell
New-Item -ItemType Directory -Force C:\IR | Out-Null
wevtutil epl Security C:\IR\Security.evtx
Get-FileHash -Algorithm SHA256 C:\IR\Security.evtx | Out-File C:\IR\hashes.txt
Search logs for CrowdStrike's indicators. This looks for the three BLOODALCHEMY command servers and their IPs from CrowdStrike's indicator table; run the same strings in the SIEM. A hit means contact with known attacker infrastructure: treat it as a likely compromise and escalate. Pass: no output.
D=/srv/ir/vapor-panda
sudo find "$D" -type f -exec zgrep -HEi 'nginxmysql\.com|sqlserver-sqlite\.com|ddduuuppp\.com|45\.153\.126\.223|89\.46\.234\.50|192\.121\.47\.20' {} +
Hash-check Windows disks. This hashes the three file names CrowdStrike lists on all local fixed disks and compares them with its published SHA-256 values. Pass: no output.
# renamed copies are missed; also search these hashes in the client's EDR
$bad = @('49fe70419fd19b81ca8d730a6ef7c1ec71b681d60b390761070d42686c7d2068','3fb5a9fb3e2cb1d6208966bd4e55d10282d19c7250d827efa560463d60a12ee4','364251838edfcf5ef1107fa692da3c5bd9a540482449f645992830134bf807ab')
Get-CimInstance Win32_LogicalDisk -Filter 'DriveType=3' | ForEach-Object { Get-ChildItem "$($_.DeviceID)\" -Recurse -Force -File -Include svchost.exe,graphics-hook-filter64.dll,graphics-hook_config.bin -ErrorAction SilentlyContinue } | Get-FileHash -Algorithm SHA256 | Where-Object Hash -in $bad
Look for ARTEX's own markers. CrowdStrike lists a C:\ProgramData\artx5v\ folder, "artx" or "artex" in command lines, and artx-prefixed cloud roles; the process list shows only what runs now. Pass: False, no process rows, and [] from every AWS profile.
Test-Path 'C:\ProgramData\artx5v'
Get-CimInstance Win32_Process | Where-Object CommandLine -match 'artx|artex' | Select-Object ProcessId,ParentProcessId,Name,CommandLine
for p in $(aws configure list-profiles); do echo "$p"; aws iam list-roles --profile "$p" --output json --query "Roles[?starts_with(RoleName,'artx')].RoleName"; done
List delegation rights in Active Directory. CrowdStrike saw the agents abuse resource-based constrained delegation, a setting that lets one account act as users on a computer; this lists the computers where that attribute is set. Pass: only entries the client's IT can explain.
Get-ADComputer -LDAPFilter '(msDS-AllowedToActOnBehalfOfOtherIdentity=*)' -Properties PrincipalsAllowedToDelegateToAccount | Select-Object Name,PrincipalsAllowedToDelegateToAccount
Find AWS servers still allowing the old metadata service. CrowdStrike advises requiring IMDSv2, the token-protected version of the service that hands servers their cloud credentials; this uses AWS's filter across profiles and regions. Pass: no instance IDs printed.
for p in $(aws configure list-profiles); do for r in $(aws ec2 describe-regions --profile "$p" --query 'Regions[].RegionName' --output text); do echo "$p $r"; aws ec2 describe-instances --profile "$p" --region "$r" --filters "Name=metadata-options.http-tokens,Values=optional" --query "Reservations[*].Instances[*].[InstanceId]" --output text; done; done
Preserve evidence before rebuilding. Copy a flagged host's C:\IR folder to the client's evidence share. Pass: the hash printed matches C:\IR\hashes.txt.
Copy-Item C:\IR "\\evidence\ir\$env:COMPUTERNAME" -Recurse
Get-FileHash -Algorithm SHA256 "\\evidence\ir\$env:COMPUTERNAME\Security.evtx"
Block the indicators. Add the three domains to the client's DNS filter and the three IPs to the firewall's outbound deny list. Pass: the lookup returns the filter's block answer or nothing.
Resolve-DnsName www.ddduuuppp.com
Rebuild hosts with a hit. Reimage machines flagged by checks 2 to 4 from known-good media; BLOODALCHEMY is a backdoor, so don't clean in place. Pass: checks 3 and 4 print nothing on the rebuilt host.
Remove cloud and AD footholds. Delete artx roles in the IAM console (Roles, then Delete), which detaches their policies automatically. Clear unexplained delegation; a service relying on it stops working. Pass: checks 4 and 5 come back clean.
Set-ADComputer <computer-name> -Clear msDS-AllowedToActOnBehalfOfOtherIdentity
Rotate keys. Reset krbtgt (the domain's Kerberos master key) twice, 10 hours apart, as Microsoft describes, then rotate local admin passwords with Windows LAPS. Pass: PasswordLastSet shows the second reset and each PasswordUpdateTime shows today.
Get-ADUser krbtgt -Properties PasswordLastSet | Select-Object PasswordLastSet
# Windows LAPS only; needs PowerShell remoting (WinRM)
$pcs = Get-ADComputer -Filter 'Enabled -eq $true'
Invoke-Command -ComputerName $pcs.DNSHostName -ScriptBlock { Reset-LapsPassword } -ErrorAction Continue
$pcs | ForEach-Object { Get-LapsADPassword -Identity $_.Name } | Select-Object ComputerName,PasswordUpdateTime
Hardening (agree with the client first): require IMDSv2. Software still making old-style calls will fail, so AWS says to wait until the MetadataNoToken metric reads zero. Pass: check 6 prints no instance IDs.
for p in $(aws configure list-profiles); do for r in $(aws ec2 describe-regions --profile "$p" --query 'Regions[].RegionName' --output text); do for i in $(aws ec2 describe-instances --profile "$p" --region "$r" --filters "Name=metadata-options.http-tokens,Values=optional" --query "Reservations[*].Instances[*].InstanceId" --output text); do aws ec2 modify-instance-metadata-options --profile "$p" --region "$r" --instance-id "$i" --http-tokens required --http-endpoint enabled; done; done; done
Recheck. Run checks 2 to 6 again. Pass: all five come back clean.
KinoSec's autonomous web app, cloud and Active Directory pentests check whether each client's internet-facing apps, cloud servers and Windows domain have the kinds of openings CrowdStrike describes: weak login setups on web apps, services exposed without a password, and paths from one foothold to domain admin. That is the same reconnaissance VAPOR PANDA automated, run with your client's permission, scope limits and a report they can act on. KinoSec does not hunt for BLOODALCHEMY on hosts; the host checks in this article do that. What it adds is an answer to the question this report raises for an MSP: if an agent knocked on a client's door, which one would open first? Run it on demand across your client base and hand each client the findings with fixes.
No. CrowdStrike says VAPOR PANDA is separate from the ARTEX activity reported under the Storm-0940 name, which CyberScoop notes Microsoft tied to a ConnectWise supply-chain attack. The indicators in this article come from CrowdStrike's VAPOR PANDA report only, so a clean result says nothing about other ARTEX users.
Search the client's DNS, proxy and firewall logs for the BLOODALCHEMY domains CrowdStrike published, for example zgrep -Ei 'nginxmysql|sqlserver-sqlite|ddduuuppp' <log>; a hit means contact with known attacker infrastructure: treat it as a likely compromise and escalate. Next, hash the three named files on Windows disks with Get-FileHash <file> | Where-Object Hash -in $bad, using CrowdStrike's three SHA-256 values. Then run Test-Path 'C:\ProgramData\artx5v', which should print False.
Leave that server on the old version and fix the software first. AWS's transition guide says to update the server's SDKs, CLI and other software to versions that support IMDSv2, and its open-source IMDS Packet Analyzer names the software still making old-style calls. Require IMDSv2 once the MetadataNoToken metric reads zero.
Yes: CrowdStrike lists corporate and think-tank accounts among the password-guessing targets, not only ministries. CyberScoop reports that agentic attacks rose from about 45 in September to 126 in October so far, and quotes CrowdStrike's Adam Meyers saying ARTEX could push an attacker past 1,500 commands an hour. CrowdStrike's own advice is ordinary hygiene: rotate keys, including old ones in backups and directory exports, and patch internet-facing appliances.