Agentic Espionage: VAPOR PANDA's ARTEX Campaign

Starting October 17, the China-nexus adversary VAPOR PANDA used the agentic framework ARTEX against more than 200 organizations in at least 14 countries over 11 days (CrowdStrike). Targets included foreign ministries, telecom providers, and US pharmaceutical, semiconductor, defense, and nuclear organizations. CrowdStrike OverWatch confirmed post-exploitation at nine organizations and found an ARTEX controller that intermittently exposed tooling, target files, and agent transcripts.

What happened

VAPOR PANDA has pursued long-term access to government, think tank, and energy organizations since 2021. CrowdStrike says this is its first observed use of AI intrusion tooling, and it widened targeting into pharmaceuticals, semiconductors, and nuclear organizations.

ARTEX coordinates a main agent with planner and worker agents over a shared graph of facts and goals. The operator ran it mainly on DeepSeek, plus a second commercial model CrowdStrike could not confirm, and the planning agents used about 1.4 billion input tokens in one intrusion. Recovered transcripts show the operator steering several engagements at once in Chinese, under the label 【人类指令】, “human instruction.”

At one US pharmaceutical organization, the agent chained an unsigned SAML assertion with an XML external entity (XXE) flaw to query the cloud Instance Metadata Service. The role it obtained could issue administration commands to thousands of instances. Elsewhere, the agents rooted a production container environment, deployed the BLOODALCHEMY backdoor, and routed traffic through Tor, SOCKS proxies, and a compromised relay.

How it could have been caught

A login service parses requests from the internet and has no reason to fetch its own cloud credentials mid-request. An XXE payload makes the parser do exactly that, so the first new behavior is a connection from the application process to the metadata endpoint. A baseline would have flagged that request seconds after the forged assertion arrived.

What this looks like in Trace

Here is the first pharmaceutical intrusion traced in the victim’s cloud. The SAML and XXE chain, the metadata query, the instance commands, and the art18- comment marker come from CrowdStrike. The workload names, process ancestry, and timings are illustrative.

Network trace. Workload web/sso-portal, a Java service that accepts SAML logins. Each row is a tuple Trace’s sensor recorded, checked against the baseline.

The commands land on thousands of instances at once, and Trace collapses them into one behavior in the same case. The proxies and relay add no cover, because the case keys on behavior inside the cloud. The operator’s model calls run on attacker infrastructure, so the AI proxy has nothing to judge here, and the evidence comes from the sensor.

Traceback. At T+0:01 the triage agent opens a case and follows the chain:

metadata request → java sso-portal → XXE in an unsigned SAML assertion → external caller, with no deploy, commit, or config change behind the parser's network access

The chain ends at an outside request, and that dead end is the finding. When the art18- commands arrive, the triage agent ties them to the sso-portal role whose credentials were read at T+0:01.

Verdict: an outside agent turning a login parser into a cloud role takeover. The case reaches the cloud security team about a minute after the metadata request, with the role named for revocation before its first command lands.

This analysis reconstructs the incident from public reporting and walks through where Trace would have raised the first alert inside the cloud of the first US pharmaceutical organization. Detection times are illustrative.