Cyber espionage group identified

A Chinese-linked cyber espionage group known as VAPOR PANDA has been using open-source tools to target a wide range of organizations across at least 14 countries, according to a report by CrowdStrike.

Tools used in attacks

The group has been utilizing ARTEX, an open-source framework that coordinates intrusion agents, to conduct operations since at least October 17. These operations have targeted more than 200 organizations, including ministries in Europe, U.S. pharmaceutical companies, semiconductor firms, defense contractors, nuclear facilities, and financial institutions.

Human instructions used

The group has been observed using a specific method involving human instructions in Chinese, which were labeled "instruction humaine" (human instruction) and directed to AI agents deployed within the network of a global pharmaceutical company. These instructions included identifying Windows machines not protected by CrowdStrike's Falcon security software, which the attackers sought to avoid.

Shift in targets

CrowdStrike reported that VAPOR PANDA has shifted its focus from primarily targeting government agencies, think tanks, and the energy sector since 2021 to now including a European ministry of foreign affairs, its presidency, the prime minister's office, and defense, justice, finance, and intelligence administrations. Another operation targeted 19 U.S. organizations in the pharmaceutical, semiconductor, defense, nuclear, and financial sectors.

Infiltration and backdoor

CrowdStrike confirmed that the group has successfully infiltrated nine of the targeted organizations, installing a backdoor known as BLOODALCHEMY, which has been known since 2023. The group has also attempted to access credentials in at least 12 other organizations, including European administrations.

AI models used

The group primarily used DeepSeek, a commercial AI model, and another commercial model that CrowdStrike could not identify. The plan agents consumed approximately 1.4 billion tokens in input during one intrusion, indicating a deliberate choice to build a toolchain independent of any single model provider, using open-source components and commercial subscriptions.

Exploitation of known vulnerabilities

The report highlights that the group did not invent new techniques but instead exploited known vulnerabilities. In a U.S. pharmaceutical laboratory, the attackers used an unsigned SAML assertion and an XML flaw to query the cloud's metadata service, obtaining a role capable of commanding thousands of instances and eventually reaching an administrator account.

Recommendations for security

CrowdStrike emphasizes that the most useful lesson from the report is the effectiveness of testing old vulnerabilities across multiple targets simultaneously. The report recommends that organizations change signing keys, pre-authentication keys, and service accounts after any data exposure, including backups and directory exports.

Future threat outlook

CrowdStrike believes that Chinese-linked groups are likely to continue adopting such tools within the next 12 months. The VAPOR PANDA server has already prepared target files for ministries of foreign affairs in Central America and Asia, although it is unclear if these operations have been launched.