A single ARTEX controller was directed at at least 14 countries within 11 days. 200+ is the number of targets, not compromises. ARTEX was not the only tool: the BLOODALCHEMY backdoor, webshells, Chisel and SoftEther were also used.
Confirmed victims
- Interior ministry of a Middle Eastern country
- Foreign ministries of two Latin American countries
- Telecom operators in the US, Belgium and the Philippines
- Other unnamed organizations (CrowdStrike confirmed post-exploitation at 9)
Targets
- 200+ organizations in at least 14 countries
- Multiple ministries of a European country
- 19 US organizations
- Foreign ministries in Central America and Asia (target files prepared)
Attribution
- ARTEX basis
- CrowdStrike relied on controller data. The models were mainly DeepSeek.
- Actor
- CrowdStrike: China-nexus; VAPOR PANDA (linked the controller to the group's infrastructure, no numeric confidence given). CyberScoop writes China state-backed.
- Same attacker?
- CrowdStrike states it is separate from Storm-0940.
Figures and definitions
| Confirmed | 9 with confirmed post-exploitation (CrowdStrike blog) |
|---|---|
| Possible | About 140, about 70% confirmed or possibly compromised at medium confidence (CyberScoop citing CrowdStrike) |
| Password spraying | At least 12 hit by spraying and credential scanning |
| Tokens | About 1.4 billion input tokens for a single intrusion |
Notes
- BLOODALCHEMY domains and hashes in the IoCs are not indicators of ARTEX itself.
Related IoCs
| Type | Value | Role | Check |
|---|---|---|---|
| Domain | nginxmysql[.]com | BLOODALCHEMY C2 domain | Platform: suspicious |
| Domain | sqlserver-sqlite[.]com | BLOODALCHEMY C2 domain | Platform: suspicious |
| Domain | www[.]ddduuuppp[.]com | BLOODALCHEMY C2 domain | Platform: malicious |
| Hash | 364251838edfcf5ef1107fa692da3c5bd9a540482449f645992830134bf807ab | BLOODALCHEMY payload file (graphics-hook_config.bin) | Platform: suspicious |
| Hash | 3fb5a9fb3e2cb1d6208966bd4e55d10282d19c7250d827efa560463d60a12ee4 | BLOODALCHEMY loader DLL (graphics-hook-filter64.dll) | Platform: malicious |
| Hash | 49fe70419fd19b81ca8d730a6ef7c1ec71b681d60b390761070d42686c7d2068 | GameHook binary renamed svchost.exe | Platform: no verdict |
| IP | 192[.]121[.]47[.]20 | IP address of www[.]ddduuuppp[.]com | Platform: no verdict |
| IP | 45[.]153[.]126[.]223 | IP address of nginxmysql[.]com | Platform: no verdict |
| IP | 89[.]46[.]234[.]50 | IP address of sqlserver-sqlite[.]com | Platform: no verdict |
| File path | graphics-hook-filter64.dll | loader DLL | Source report only |
| File path | graphics-hook_config.bin | payload file | Source report only |
Sources (4)
- 2026-10-29 Vendor CrowdStrike Counter Adversary Operations VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign
- 2026-10-30 Media CyberScoop China-backed threat group used agentic AI pentesting tool to compromise 140 sensitive targets in 11 days
- 2026-11-02 Media BleepingComputer Chinese hackers use ARTEX AI in automated attacks against 200 orgs
- 2026-11-02 Media iTnews ARTEX AI hacking framework spreads to another China-linked group