CrowdStrike’s October 29, 2026, report adds three case-level accounts of intrusion paths and a list of BLOODALCHEMY files and infrastructure indicators to its account of the VAPOR PANDA campaign. The company says the activity began October 17 and was observed over an 11-day window. CrowdStrike’s report says the campaign targeted more than 200 organizations in at least 14 countries; CrowdStrike Intelligence confirmed post-exploitation at nine, while at least 12 additional organizations faced credential scanning or password spraying.
CrowdStrike says VAPOR PANDA ran ARTEX primarily with DeepSeek and also used a second, unidentified commercial language model. A human operator directed the agents and intervened at decision points. Our earlier coverage of multiple groups’ use of ARTEX provides broader context, alongside our report on CrowdStrike’s attribution of the campaign and DeepSeek’s reported role.
Three intrusion paths CrowdStrike described
CrowdStrike’s case accounts concern two U.S.-based pharmaceutical organizations and a Greek government entity. The company did not identify the organizations.
In one pharmaceutical case, an agent chained an unsigned SAML assertion with an XXE flaw, short for XML external entity. CrowdStrike says the sequence let it query a cloud instance metadata service and obtain a role with administration-command capability. The agent later recovered an enterprise administrator account.
A separate pharmaceutical case involved web shells and root access in a production container environment through an unauthenticated orchestration service. CrowdStrike says agents then read LAPS passwords and abused resource-based constrained delegation to impersonate a privileged account.
For the Greek government entity, an operator supplied an old mail-server directory export containing authentication keys that CrowdStrike assessed were likely not rotated after export. Agents used the keys to forge an administrator token and read mailboxes, then used VPN details recovered from email.
BLOODALCHEMY files and infrastructure
CrowdStrike says VAPOR PANDA deployed BLOODALCHEMY at a Middle East-based interior ministry and a Latin America-based foreign ministry. Its report lists these command-and-control (C2) domains and IP addresses, plus hashes for three files associated with the malware:
| Indicator or file | Published value | Reported role |
| C2 domain and IP | nginxmysql[.]com · 45.153.126[.]223 | BLOODALCHEMY command-and-control infrastructure |
| C2 domain and IP | sqlserver-sqlite[.]com · 89.46.234[.]50 | BLOODALCHEMY command-and-control infrastructure |
| C2 domain and IP | www[.]ddduuuppp[.]com · 192.121.47[.]20 | BLOODALCHEMY command-and-control infrastructure |
svchost.exe | 49fe70419fd19b81ca8d730a6ef7c1ec71b681d60b390761070d42686c7d2068 | Renamed GameHook binary |
graphics-hook-filter64.dll | 3fb5a9fb3e2cb1d6208966bd4e55d10282d19c7250d827efa560463d60a12ee4 | BLOODALCHEMY loader DLL |
graphics-hook_config.bin | 364251838edfcf5ef1107fa692da3c5bd9a540482449f645992830134bf807ab | BLOODALCHEMY payload file |
CrowdStrike describes the file sequence as the renamed svchost.exe loading graphics-hook-filter64.dll, which decrypted graphics-hook_config.bin.
Defensive measures tied to the reported paths
CrowdStrike recommends rotating signing keys, preauthentication keys and service credentials after suspected exposure, including keys and credentials in older backups or directory exports. That guidance is relevant to the Greek case’s old export and authentication keys. For the SAML and cloud-access path, the company recommends enforcing SAML signature validation, requiring IMDSv2 and limiting cloud command-execution permissions to the instances that need them.
CrowdStrike also recommends patching internet-facing appliances, hunting for ARTEX markers and maintaining real-time endpoint detection and response coverage, including on servers not considered internet-accessible.
