HighThreat actor · 2026-10-30

VAPOR PANDA runs ARTEX AI-agent attack framework against 200+ orgs

What happened

CrowdStrike says China-nexus VAPOR PANDA ran ARTEX, an AI agent attack framework (DeepSeek plus a second LLM), against 200+ organizations in 14+ countries starting Oct 17. Post-exploitation confirmed at 9 orgs, deploying BLOODALCHEMY (a ShadowPad derivative).

Who's affected

Foreign ministries; US pharma, semiconductor, defense, nuclear and finance; telcos.

✅ Fix / patch

Audit EDR coverage gaps today: the operator told agents to find Windows hosts WITHOUT the EDR sensor.
Review sign-in logs for password spraying and SAML/XXE cloud-credential abuse.

🔎 Quick hunt check

BLOODALCHEMY C2 nginxmysql[.]com, sqlserver-sqlite[.]com, www[.]ddduuuppp[.]com. Loader graphics-hook-filter64.dll side-loaded by a renamed svchost.exe. Also hunt artx/artex in command lines and C:\ProgramData\artx5v\.

Hunt queries

Starting points built only from published indicators. Field names vary; tune before use.

(index=* (query IN ("nginxmysql.com","sqlserver-sqlite.com","www.ddduuuppp.com") OR dest_ip IN ("45.153.126.223","89.46.234.50","192.121.47.20") OR dest IN ("45.153.126.223","89.46.234.50","192.121.47.20") OR file_hash IN ("49fe70419fd19b81ca8d730a6ef7c1ec71b681d60b390761070d42686c7d2068","3fb5a9fb3e2cb1d6208966bd4e55d10282d19c7250d827efa560463d60a12ee4","364251838edfcf5ef1107fa692da3c5bd9a540482449f645992830134bf807ab") OR file_name IN ("graphics-hook-filter64.dll","graphics-hook_config.bin") OR CommandLine="*artx*" OR CommandLine="*artex*" OR file_path="*\\ProgramData\\artx5v\\*"))
| stats count min(_time) as first max(_time) as last by host, sourcetype

let doms = dynamic(["nginxmysql.com","sqlserver-sqlite.com","www.ddduuuppp.com"]);
let ips = dynamic(["45.153.126.223","89.46.234.50","192.121.47.20"]);
let hashes = dynamic(["49fe70419fd19b81ca8d730a6ef7c1ec71b681d60b390761070d42686c7d2068","3fb5a9fb3e2cb1d6208966bd4e55d10282d19c7250d827efa560463d60a12ee4","364251838edfcf5ef1107fa692da3c5bd9a540482449f645992830134bf807ab"]);
union isfuzzy=true
 (DeviceNetworkEvents | where RemoteIP in (ips) or RemoteUrl has_any (doms)),
 (DnsEvents | where Name in~ (doms)),
 (DeviceFileEvents | where SHA256 in (hashes) or FileName in~ ("graphics-hook-filter64.dll","graphics-hook_config.bin") or FolderPath has @"ProgramData\artx5v"),
 (DeviceImageLoadEvents | where SHA256 in (hashes) or FileName =~ "graphics-hook-filter64.dll"),
 (DeviceProcessEvents | where SHA256 in (hashes) or ProcessCommandLine has_any ("artx","artex"))
| project TimeGenerated, DeviceName, RemoteIP, RemoteUrl, Name, FileName, FolderPath, SHA256, ProcessCommandLine

destination.ip:("45.153.126.223" or "89.46.234.50" or "192.121.47.20") or dns.question.name:("nginxmysql.com" or "sqlserver-sqlite.com" or "www.ddduuuppp.com") or file.hash.sha256:("49fe70419fd19b81ca8d730a6ef7c1ec71b681d60b390761070d42686c7d2068" or "3fb5a9fb3e2cb1d6208966bd4e55d10282d19c7250d827efa560463d60a12ee4" or "364251838edfcf5ef1107fa692da3c5bd9a540482449f645992830134bf807ab") or file.name:("graphics-hook-filter64.dll" or "graphics-hook_config.bin")

⏱ CISA deadline

Not in CISA KEV as of Oct 31, 2026.

Sources

CrowdStrike