Post-exploitation activity has been confirmed at nine organizations, allowing the attacker to deploy BLOODALCHEMY , a derivative of ShadowPad, followed by credential spraying, network scanning, and reconnaissance.
Vapor Panda is also said to have conducted password-spraying and credential-scanning activity against at least 12 additional organizations, including U.S.-based think tanks and government entities in Europe.
Central to the operation is the use of ARTEX with DeepSeek and an as-yet-unknown, subscription-based commercial large language model (LLM) to conduct the intrusions at scale, leveraging an army of planner and worker agents that coordinate with each other in pursuit of a common goal to move from initial access to host reconnaissance and lateral movement.
A human operator in the loop oversees the operation, directing the agents to write web shells, extract domain administrator passwords, and enumerate endpoint sensor coverage.
"In a single intrusion, Vapor Panda's planning agents consumed on the order of 1.4 billion input tokens, indicating the scale of the automated activity and implying far higher consumption across the operation as a whole," CrowdStrike said.
Unlike some campaigns that used to assist with individual digital break-ins, the use of ARTEX is at a much higher level to run multiple engagements concurrently, with the human operator only stepping in to steer the agents to accomplish their objective, while taking steps to bypass endpoint defenses.
Analysis of the recovered transcripts highlights the use of ARTEX in combination with tried-and-tested approaches -
"Across these engagements, the agents pursued multiple attack paths in parallel, spanning web applications, cloud services, container environments, Active Directory, and mail and VPN infrastructure," CrowdStrike explained. "They shifted to alternative approaches when a path failed. This breadth likely enables a single operator to apply a wider range of techniques against more targets at once than would be feasible through manual operations."
The development comes as ARTEX has witnessed broad adoption among threat actors in a short span of time, prompting its developer Li Puhua ("Autumn-27") to take it closed source.
"It orchestrates multiple LLM backends to autonomously perform reconnaissance, vulnerability identification, and exploitation, significantly lowering the technical barrier for conducting complex intrusion campaigns," Zscaler ThreatLabz said in a report published earlier this month.
The disclosure also coincides with the emergence of four previously undocumented China-linked state-sponsored threat groups known as Hollow Panda, Overcast Panda, Titan Panda, and Veiled Panda, which have targeted a broad range of sectors across the world for intelligence gathering and intellectual property theft.
Overcast Panda, described as "one of the most operationally sophisticated and persistent threats facing organizations with personnel traveling to China," has been linked to close access intrusions in which the adversary has deployed their proprietary FlowCloud backdoor on victims' devices via direct physical access when those targets were in the country.
FlowCloud is launched by means of DLL sideloading, with its components designed to fly under the radar and resist forensic analysis. Command-and-control (C2) is accomplished through legitimate cloud infrastructure in an attempt to further conceal their presence.
"FlowCloud itself is a sophisticated, purpose-built tool uniquely associated with Overcast Panda," CrowdStrike said. "Once deployed, FlowCloud provides the adversary with persistent, covert remote access to the target device, enabling keylogging, screen capture, file collection, and credential harvesting."
Titan Panda, on the other hand, has been observed targeting legal billing software by exploiting a hard-coded Internet Information Services (IIS) machine key vulnerability in Intapp Time Server to achieve remote code execution across law firms.
The attacks, first detected in April 2026, led to the deployment of an in-memory framework called IceGiant to carry out reconnaissance, persistence, lateral movement, and data exfiltration. The threat actor is assessed to be operational since at least 2021, compromising several legal organizations in North America for over two years.
"How Titan Panda obtained the default machine keys is unknown, though IIS compromise of a legal entity running Intapp Time Server may have exposed the hardcoded keys in the application's configuration file, enabling ViewState deserialization attacks against any organization running default installations," CrowdStrike said.