CrowdStrike Counter Adversary Operations published an analysis on 29 October of a campaign run with ARTEX, the agentic offensive framework we covered last week from Google's report on the same tooling.

Google's piece gave the telemetry. This one gives the scoreboard, and the scoreboard has two numbers that need to be read together.

Two hundred, and nine

From 17 October, ARTEX was used against more than 200 distinct organisations worldwide, in at least 14 countries, over an 11-day window.

Post-exploitation was confirmed at 9 organisations. Password spraying and credential scanning reached at least 12 more.

Both numbers are real and they measure different things. Two hundred is the reach of an automated sweep. Nine is the count of places where somebody got in and did something afterwards. Anyone quoting this campaign with only the first figure is reporting the scan, not the intrusion.

One engagement targeted 19 US organisations across pharmaceutical, semiconductor, defence, nuclear and financial sectors. Elsewhere the named sectors are foreign ministries, semiconductor, defence, think tanks and telecommunications.

The instruction

The line that carries the report is the operator's own prompt to the agents: "find Windows machines in the domain without Falcon, judging by tasklist and folder listings."

Read that twice. The agent was not told to evade detection. It was told to go and find the machines that have none, and to work it out from process lists and directory contents, which is how a person would do it.

It was not autonomous

CrowdStrike is clear that a human stayed in the loop and intervened only to steer the agents at decision points. The framework runs a main agent with planners and workers over a shared graph, carries an engagement from initial access through host reconnaissance and lateral movement, runs several engagements in parallel, and switches approach when one fails.

That is a force multiplier with a person at the top of it, not a machine running on its own.

Nothing new got them in

This is the part that should take the edge off the panic, and it is the part most coverage leaves out.

The access vectors were unsigned SAML assertions and an XXE flaw. A directory export from 2022, with keys that were likely never rotated, used to forge an administrator token. VPN configurations recovered out of sent mail. A VPN client key the operator said came from a May 2024 email leak. An unauthenticated orchestration service handing out root inside a container. Password spraying.

Four-year-old credentials. A two-year-old leak. The speed was new. The doors were the ones that have been open the whole time.

The tooling

CrowdStrike names BLOODALCHEMY, a backdoor first publicly documented in October 2023, deployed at a Middle East interior ministry and a Latin American foreign ministry. It arrives as a renamed GameHook binary posing as svchost.exe, with a loader called graphics-hook-filter64.dll and a payload file called graphics-hook config.bin. The implant still carries the developer's own build path, a folder called ProjectX on a D drive. Also present: JSP and PHP web shells, Chisel and SoftEther tunnels, Tor and SOCKS proxies.

Three names, one framework

Here is the thing our earlier piece set up, and it is now worth saying plainly.

Google's report named its cluster UNC7228 and placed it alongside an actor Microsoft describes as PRC-nexus. CrowdStrike names VAPOR PANDA, mentions neither UNC7228 nor the WARP PANDA cluster another vendor has been reporting on, and states that this campaign is separate from the Storm-0940 ARTEX activity reported elsewhere in the industry.

So at least three differently named clusters are using the same framework, and the vendors are not reconciling their names. ARTEX is not one actor's tool. Treating a sighting of it as attribution to anybody is a mistake that is about to be made repeatedly.

CrowdStrike hedges where it should. The adversary likely compromised a third Latin American foreign ministry. A second commercial model backend was one it could not confirm.

Forecast, marked as one

CrowdStrike assesses that China-nexus adversaries will highly likely continue adopting agentic frameworks such as ARTEX over the next 12 months. That is an assessment about the future, not an observation, and it belongs in a different column from the nine.

What to do

  • Find the hosts with no endpoint agent before somebody else does. That inventory gap is now an explicit targeting criterion, written into a prompt.
  • Rotate keys from any directory export, however old. A 2022 file was good enough to forge an administrator token in October 2026.
  • Search sent mail for VPN configurations and client keys. That is where this operator found them.
  • Put unauthenticated orchestration endpoints on the list of things that must never be reachable. Root in a container is still root somewhere.
  • Alert on sweep rates rather than techniques. The techniques here are ordinary; the pace is not.
  • Stop attributing on tooling alone.

What is not established

  • Who VAPOR PANDA is, beyond the cluster name and the China-nexus assessment.
  • What happened at the 200 organisations that are not among the nine. Reached is not compromised.
  • Whether the three vendor clusters overlap. None of the reports says.
  • Which models the framework used. One backend could not be confirmed.
  • Whether the forecast holds. It is an assessment with a 12-month horizon.
  • How much of the campaign was the agent and how much was the operator steering it.