VAPOR PANDA 利用 ARTEX 在 11 天内攻击 200 多家机构：9 家确认遭后续入侵，CrowdStrike 发现三条已披露得手路径均利用传统安全缺陷VAPOR PANDA Uses ARTEX Against 200+ Organizations in 11 Days: Nine Confirmed Compromises and Three Disclosed Entry Paths Exploiting Legacy Security Weaknesses

Per CrowdStrike's report, an actor it tracks as VAPOR PANDA used ARTEX, an open-source multi-agent penetration-testing framework, from October 17, 2026, against more than 200 organizations in at least 14 countries over an 11-day window. Targets included foreign ministries in Latin America, Europe, Asia and the Middle East, U.S. organizations in the semiconductor, defense, pharmaceutical, nuclear and financial sectors (one engagement alone aimed at 19 U.S. organizations), and telecommunications providers in several regions. The 200-plus figure is a target count, not a victim count: CrowdStrike confirmed post-exploitation activity at nine organizations, where the actor gained access, deployed a backdoor and continued with credential spraying, network scanning and reconnaissance; at least 12 additional organizations saw password spraying and credential scanning with no confirmed compromise. ARTEX coordinates a main agent with subordinate planner and worker agents over a shared graph of facts, findings and goals, advancing each engagement (called a task in the framework) from initial access through host reconnaissance and lateral movement. The framework ran primarily on the DeepSeek LLM, supplemented by a second, subscription-based commercial LLM that CrowdStrike could not identify. CrowdStrike records that in one intrusion, the planning agents' input token consumption was on the order of 1.4 billion. That figure is not the campaign total; CrowdStrike assesses the cumulative consumption across the campaign was likely far higher, without giving a complete count. The framework did not run unsupervised: recovered transcripts show a single operator issuing instructions in Chinese at decision points, the instructions marked with the label (human instruction) and timestamped in China Standard Time, directing the agents to write web shells, extract domain administrator passwords and inventory endpoint sensor coverage. In one instruction the operator had the agents find Windows machines in the domain without the Falcon sensor installed, checking via tasklist and folder listings. The three disclosed entry paths used no new vulnerability. At one U.S. pharmaceutical organization, the agent chained an unsigned SAML assertion and an XXE flaw to query the cloud instance metadata service, obtaining a role able to issue administration commands to thousands of instances, then escalated to an enterprise administrator account. At a second U.S. pharmaceutical organization, the agent deployed web shells, abused an unauthenticated orchestration service to obtain root in a production container environment, read LAPS passwords and abused resource-based constrained delegation to impersonate a privileged account. At a Greek government entity, the operator supplied a 2022 directory export from the organization's mail server whose authentication keys had likely not been rotated since the export; the agent forged an administrator token with those keys and read mailboxes, then used VPN configurations recovered from a user's sent mail, together with a VPN client key from a May 2024 email leak, to reach the internal network. At the nine confirmed organizations the actor deployed BLOODALCHEMY, a backdoor first publicly documented in October 2023, over command and control infrastructure not seen in prior public ARTEX reporting. The 'China-nexus' designation is CrowdStrike's assessment, resting on telemetry-internal evidence including the Chinese-language instructions, China Standard Time timestamps and in-group slang; no second organization has independently published on state attribution for this campaign, and this entry records it as CrowdStrike's assessment, not as a confirmed fact. Likewise, that the framework ran on DeepSeek's model is CrowdStrike's observation; its report does not claim the provider knew of or took part in the campaign.

Split record for the first path: SAML assertion handling involved a signature validation failure at the identity verification boundary, Access Control-C4. The XXE exploitation was a safe input handling failure and is not folded into Access Control-C4. The metadata step exposed cloud role credentials through insufficient metadata access protection, for which IMDSv2 is the source report's recommended control and v1.0 has no direct check. The role's ability to command thousands of instances was an excessive authorization scope, Access Control-C2.

The load-bearing structure of this case fits in two sentences: the amplifier is new, and every way in was old. ARTEX hands reconnaissance, trial and error, path switching and parallel execution to a multi-agent division of labour, so one operator can hold many engagements at once; but each of the three disclosed entry paths rested on a problem that has sat on defenders' ledgers for years: assertion signatures not validated, authentication keys from a 2022 export that CrowdStrike assessed had likely not been rotated since the export (close to four years by the time of the campaign), an internal orchestration service with no authentication, and a cloud role powerful enough to command thousands of instances. The agents changed the speed and concurrency with which those old problems get exploited, not the problems themselves. That is also where this entry parts from generic 'AI attack' framing: book the case against the framework or the model and the victims go shopping for new defensive products; book it against the entries and the fix list is signature validation, rotation, least privilege and an inventory of unauthenticated services, all existing checks. The primary failure layer is therefore Access Control, assigned on the victim side failure surface (DeepWing judgment). Item by item against the framework checks: accepting an unsigned SAML assertion means the determination did not happen before execution, against Access Control-C4 (interception truly before the fact: determination before execution, default deny when determination is unavailable); when validation was absent, the system chose to let it through. Authentication keys from a 2022 export, which CrowdStrike assesses had likely never been rotated since the export, close to four years by the time of this campaign, and still able to forge an administrator token, sit against Access Control-C5 (key custody and rotation: keys centrally held, rotation on record); keys inside historical exports and backups are on the rotation ledger too, and CrowdStrike's first recommendation is exactly to rotate signing keys, preauthentication keys and service credentials including those in historical backups and directory exports. Three things must be kept apart: the keys in the export file, the keys in the current production environment, and any other historical copies; the public record supports a judgment on the first only. A cloud role able to issue commands to thousands of instances sits against Access Control-C2 (scoping kept minimal: authorisation matching task need); its scope plainly exceeds any single task. The unauthenticated orchestration service is not booked against C2: it let a caller reach production root with no authenticated identity at all, a missing internal service authentication for which the v1.0 Access Control checks have no direct item; it is recorded as an unmapped framework gap. Access Control-C4 is adjacent, since both involve a determination missing before execution, but C4 does not itself require service to service authentication, so C4 is not recorded as confirmed failed on this point. Observability is involved as an open check only, with no failure found: at least 12 organizations saw password spraying and credential scanning without confirmed follow-on intrusion, and the public record does not say whether those attempts raised alerts, were blocked automatically or were handled by analysts; no confirmed compromise does not mean monitoring saw nothing. Access Control-C9 (scale has a ceiling) and Observability-C6 (reaction to usage anomalies) are recorded as defender side open checks. What is established is the attacker's intent and capability: the operator wrote sensor coverage inventory into the workflow and had the agents enumerate Windows hosts without the Falcon sensor. The record proves the actor could identify monitoring gaps; it does not prove those sensor-less hosts were the actual entries. For defenders, monitoring coverage gaps may inform how an attacker selects targets and adjusts paths: a monitoring blind spot is not only a defensive gap, it is also intelligence the attacker can use. The coordination structure also includes a graph of facts, findings and goals shared by the main, planner and worker agents. It allows findings from one task to be reused by others and is the architectural feature that distinguishes the framework from several isolated tools. The report observes parallel engagements and one operator intervening at decision points, but it offers no comparison without a shared graph. It therefore establishes only that the shared graph and parallel operation occurred together; it does not isolate how much speed, concurrency or scale the graph itself caused. Orchestration is the attacker's capability source in this case, not the victim side failure layer, so it is not the primary layer here; the framework and model side ledger (circulation of an open-source penetration framework, abuse monitoring by model services) has its own register home and is not mixed into this victim side case.

Target counts are not victim counts: the 200-plus figure is the number of organizations targeted, nine are confirmed to have suffered follow-on intrusion, and at least 12 more have password spraying and credential scanning on record. No confirmed compromise does not mean unaffected, but the full target set cannot be written up as victims either. Quotations keep each figure with its own counting basis. This is the register's standard wording.

Fix the entries before buying agent defence: each of the three disclosed entry paths rests mainly on existing checks (signature validation, rotation and least privilege); the unauthenticated service has no direct corresponding check and is recorded as an unmapped framework gap. Budget spent on 'AI attack defence' products before those are closed is spent on the amplifier, not the door.

Historical exports are live keys: keys inside directory exports, backups and handover files do not expire on their own. The rotation ledger has to cover historical copies; rotating only production keys leaves every old export holding a permanent key.

Monitoring blind spots are intelligence the attacker can use: enumerating sensor-less hosts is already a standard step in the actor's workflow, which proves intent and capability to identify coverage gaps, not that those hosts served as entries. Defenders should audit in the same terms: a monitoring blind spot is not only a defensive gap but also attacker-usable intelligence, and the gap list is handled as sensitive material.

Token consumption measures scale, not effect: the roughly 1.4 billion input tokens record the planning agents' activity volume in one intrusion; they translate neither into attack effect nor into degree of autonomy, and the figure travels with its counting basis (one intrusion, planning agents, input tokens).

Book attribution and mechanism separately: the mechanism (entries, paths, scale) rests on telemetry, while the attribution (state linkage) is one vendor's assessment. Citing the mechanism does not require accepting the attribution, and mixing the two ledgers means a change in attribution would wrongly drag the mechanism findings down with it.