What CrowdStrike observed

In its October 29 report, CrowdStrike attributes an ARTEX campaign to VAPOR PANDA. Activity began October 17 and targeted more than 200 organizations across at least 14 countries. It confirmed activity after compromise at nine organizations. The 200 targets are not 200 confirmed compromises.

ARTEX coordinated planning and worker agents using shared findings. DeepSeek was the principal model; another commercial model remains unidentified. Human operators supplied instructions and redirected work. The campaign included intrusions into two Latin American foreign ministries and a likely compromise of a third.

One reported chain combined an unsigned SAML assertion and an XML external entity flaw to obtain cloud credentials with command execution permissions. Other activity involved directory delegation abuse, old authentication keys, searches for hosts without sensors, and the BLOODALCHEMY backdoor. CrowdStrike distinguishes this campaign from ARTEX activity reported as Storm-0940. These are findings from the provider’s investigation, not an independent Oktsec examination of victim systems. Read CrowdStrike’s campaign report.

Verify what your SAML service actually validates

Owner: identity and application teams. In a test tenant, check whether the service provider rejects an assertion whose signature is missing, invalid or made with an untrusted key. Then check the expected issuer, audience, recipient and validity period. Confirm that the application consumes the assertion that was validated. OWASP documents these checks and the risks from XML signature wrapping in its SAML security guidance.

Keep the rejected request, validation result and application outcome together. An error in an identity log is insufficient evidence if the application still creates a session. Use fictitious users and do not place assertion contents, session tokens or signing keys in a shared ticket.

Check running instances and their roles

Owner: cloud platform team. Inventory EC2 instances whose metadata options still allow requests without an IMDSv2 token. AWS provides this read-only query; it covers the selected account and Region, so repeat it across your inventory:

aws ec2 describe-instances \
  --filters "Name=metadata-options.http-tokens,Values=optional" \
  --query 'Reservations[].Instances[].InstanceId' \
  --output text

Use MetadataNoToken and, where needed, the IMDS Packet Analyzer to identify software still using IMDSv1 before requiring IMDSv2. Check existing instances as well as launch templates: changing a template does not update machines already running. After enforcement, monitor MetadataNoTokenRejected for rejected legacy requests. AWS documents the migration sequence.

Our additional check: select one application role and list the systems it can administer. Ask the owner to justify each permission that can execute commands or change another identity. Record the effective permissions and the resources they cover. A metadata setting and an authorization review answer different questions; retain evidence for both.

Make delegation changes visible

Owner: Active Directory and detection teams. Review changes to msDS-AllowedToActOnBehalfOfOtherIdentity on computer objects. Microsoft’s Sentinel detection uses event 5136 to identify changes relevant to resource based constrained delegation.

First verify that the event is collected. Microsoft states that the modified object needs the appropriate SACL entry for auditing writes to the attribute. A change can produce a deleted value and an added value; retain both when available. Event 5136 reference.

In an approved lab, make a reversible delegation change and trace it from the domain controller to the analyst’s queue. The analyst should identify the actor, object, attribute and change record. Missing events are a collection gap. An authorized change is not automatically malicious.

Close the investigation on exposed credentials

Owner: incident response and service owners. For each known exposure, review the closure record. It should identify the credential type, the service that trusts it, the replacement or revocation action, and the verification result. Include credentials found in old backups and exports in that review.

Test revocation with a disposable credential in an isolated environment: establish access, revoke it, and verify what happens to both a new connection and an existing session. Record the behavior of the actual service. This is a proposed validation exercise, not a claim that every system in the reported campaign behaved the same way.

Find machines missing from the SOC’s view

Owner: endpoint operations and SOC. Compare your asset inventory with the devices reporting to your security platform. For a sample of discrepancies, ask the system owner to demonstrate a recent event arriving at the SOC. Document inactive sensors, stale records, unsupported systems and approved exceptions separately.

Choose a critical service and trace its dependencies through application servers, identity services and administration hosts. Every exception needs an owner and an alternative way to investigate activity. Keep the resulting list with the service’s response runbook so an incident responder does not have to reconstruct it during containment.

Where the Argentine healthcare article fits

Our analysis of AI agents attacking Argentine healthcare examines a separate campaign. Its victim count and intrusion timelines do not belong to this case. Read it alongside this article to compare the documented workflows and the checks each investigation supports.

What to take to the next security review

Bring the rejected SAML tests, the metadata inventory, the role review, a collected delegation event, credential revocation results and the sensor coverage exceptions. For each unresolved item, record the affected service, responsible team and next verification step. That gives the review a concrete set of decisions about access, detection and response.

Sources reviewed October 30, 2026. Campaign findings are attributed to CrowdStrike. The validation exercises are Oktsec recommendations for environments you own or are authorized to assess.