Chinese Hackers Use ARTEX AI to Target 200+ Organizations Across 14 Countries

A China-linked espionage group has used an open-source AI agent framework to run intrusion attempts against more than 200 organizations in at least 14 countries in under two weeks, according to CrowdStrike. The group, tracked as Vapor Panda, is reported to have confirmed post-exploitation activity at nine organizations. The campaign, first published by CrowdStrike on October 29, 2026 and widely covered through November 2, is one of the clearest public examples yet of agentic AI being used to multiply the reach of a small state-aligned team.

For industrial and critical-infrastructure defenders, the lesson is less about exotic AI tradecraft and more about speed and breadth: the agents reportedly leaned on familiar weaknesses such as stale keys, weak SAML validation, exposed management services and cloud metadata access, and chased many of them at once.

What happened: Vapor Panda’s ARTEX AI campaign at a glance

CrowdStrike reports that from October 17, 2026, a single ARTEX controller linked to Vapor Panda infrastructure directed exploitation attempts against more than 200 distinct organizations across at least 14 countries over an 11-day window. Reported targets included:

• Foreign ministries in Latin America, Central America, Asia and Europe, plus a Middle East interior ministry.
• A European country’s foreign ministry, presidency and prime minister’s office, along with defense, justice, finance and intelligence entities.
• 19 U.S.-based organizations across pharmaceutical, semiconductor, defense, nuclear and financial sectors, plus think tanks.
• Telecommunications providers in the U.S., Belgium and the Philippines.

CrowdStrike confirmed post-exploitation activity at nine organizations, and observed password-spraying and credential-scanning against at least 12 more, including U.S. think tanks and European government entities. The 200-plus figure describes organizations targeted, not organizations breached. CrowdStrike also describes this as Vapor Panda’s first observed use of AI-driven intrusion tooling.

What is ARTEX?

ARTEX is a Go-based, multi-agent AI penetration-testing framework that connects to external large language models and automates reconnaissance, vulnerability identification and exploitation. It was published on GitHub this year by a developer using the handle Autumn-27. After it was linked to real-world attacks, including intrusions at South Korean financial institutions, the developer announced on October 8 that the project would go closed source with no further releases, and said the misuse was unrelated to them. Copies and derivatives, including English- and Korean-language versions and a commercial edition reported as ARTEX Pro, continue to circulate, according to BleepingComputer and iTnews citing Google Threat Intelligence Group and Mandiant.

Because ARTEX is a harness rather than a model, it can run on different backends. In this campaign CrowdStrike says Vapor Panda ran it primarily on DeepSeek, supplemented by a subscription-based commercial LLM that CrowdStrike could not identify.

Attack methodology: how the AI agents worked

Agent architecture and human oversight

ARTEX uses a main agent that delegates to planner and worker agents, which share a graph of facts, findings and goals. CrowdStrike says recovered transcripts show a human operator, instructing in Chinese, stepping in at decision points: for example, directing agents to write web shells, extract domain administrator passwords and enumerate endpoint sensor coverage. At a global pharmaceutical organization, the operator reportedly told agents to find Windows machines without CrowdStrike Falcon installed. In one intrusion, the planning agents consumed on the order of 1.4 billion input tokens, which CrowdStrike says implies far higher consumption across the whole operation.

Familiar techniques, pursued in parallel

CrowdStrike stresses that the agents did not need novel exploits. Reported attack paths from the transcripts included:

• Cloud pivot: chaining an unsigned SAML assertion and an XML external entity (XXE) flaw to query the cloud Instance Metadata Service, obtaining a role able to issue administration commands to thousands of instances, then escalating to an enterprise administrator account.
• Container and Active Directory abuse: deploying web shells, abusing an unauthenticated orchestration service to reach root in a production container environment, reading Local Administrator Password Solution (LAPS) passwords, and using resource-based constrained delegation to impersonate a privileged account.
• Stale credentials and leaked material: using authentication keys not rotated since 2022 to forge an administrator token and read mailboxes, then using VPN configurations recovered from a user’s sent mail and a VPN client key from a reported May 2024 email leak to reach an internal network.

The agents reportedly worked web applications, cloud services, containers, Active Directory, mail and VPN infrastructure at the same time and switched paths when one failed. At the nine confirmed victims, the actor deployed BLOODALCHEMY, a ShadowPad derivative first documented publicly in 2023, then ran credential spraying, network scanning and reconnaissance. CrowdStrike reports the backdoor communicated with Vapor Panda infrastructure, including domains not seen in earlier public ARTEX reporting.

Threat actors and attribution

Confirmed by the researcher (CrowdStrike’s assessment): the activity is attributed to Vapor Panda, a China-based, state-sponsored targeted intrusion adversary CrowdStrike has tracked since February 2021 (previously VexatiousTemper). The Hacker News notes an overlap with the cluster Trend Micro calls Earth Estries; community names also include ProxyLogon-era activity. Attribution rests on CrowdStrike’s linkage of the ARTEX controller and BLOODALCHEMY C2 to Vapor Panda infrastructure.

Not the same as other ARTEX activity: CrowdStrike says this campaign is separate from the ARTEX-driven ConnectWise Cloud Backup supply-chain compromise that Microsoft attributed on October 21 to Storm-0940, another China-aligned group, and from ARTEX use against South Korean financial institutions and Japanese companies. Zscaler assessed its South Korea actor as financially motivated. Shared tooling does not imply a shared operator, which makes ARTEX a poor basis for attribution on its own.

Unknown: the identity of Vapor Panda’s operators, the second commercial LLM provider, and how many of the targeted organizations were actually compromised beyond the nine confirmed. One outlet (CyberScoop) reported roughly 140 compromised targets, a figure that does not match CrowdStrike’s confirmed nine and should be treated cautiously until reconciled.

Impact assessment

• Confirmed: post-exploitation at nine organizations, plus credential-attack activity at 12 others. Victim names have not been published; CrowdStrike’s list is by sector and geography.
• Strategic: the targeting profile (diplomatic, defense, nuclear, semiconductor, pharmaceutical, telecom) is consistent with intelligence collection and long-term access development. CrowdStrike frames the AI as letting a small team expand its target set rather than changing the group’s mission.
• Operational and financial: no service disruption, data-theft volume or loss figure has been reported for this campaign. Anyone quoting such numbers should be asked for a source.
• Regulatory: none reported. Organizations in the affected sectors should expect questions from regulators if intrusions are confirmed.
• Forward-looking: CrowdStrike assesses it is highly likely that China-nexus actors will keep adopting agentic frameworks like ARTEX over the next 12 months, and that the pharmaceutical, semiconductor and defense targeting is likely to continue.

IT, OT, IoT and industrial cybersecurity implications

No public report says Vapor Panda reached operational technology or ICS/SCADA networks in this campaign, and readers should not infer it. The relevance for OT teams is indirect but real:

• The entry points are IT and identity. Cloud roles, SAML, Active Directory, VPN and mail are the same routes attackers use to reach plant and utility environments from the enterprise side. Nuclear, semiconductor and pharmaceutical manufacturers appear among the targets, and these sectors run large OT estates.
• Parallel, tireless attackers compress dwell-time assumptions. Microsoft reported that Storm-0940’s ARTEX-assisted attacks reached privileged cloud access in under three hours in several cases, across sectors including aerospace, automotive, chemicals, defense, energy and manufacturing (per SecurityWeek’s summary). Detection and segmentation that rely on an attacker being slow will be tested.
• Stale secrets are the cheapest wins. Keys unrotated since 2022 and VPN material from a 2024 leak are exactly the kind of long-lived trust that jump hosts, remote-access gateways and OT vendor connections accumulate.
• Exposed management services matter. An unauthenticated orchestration service gave root in a container environment. Any management plane reachable from a compromised IT segment, including engineering workstations and historian or remote-support gateways, deserves the same scrutiny.

Related ARTEX incidents (separate from Vapor Panda)

• Storm-0940 / ConnectWise (Microsoft, Oct 21): ARTEX-assisted OAuth abuse, password spraying and use of compromised ConnectWise application identities against customer Microsoft 365 environments. Microsoft said the issue was not a flaw in its own products.
• South Korea and Japan: CrowdStrike linked an attacker to breaches at South Korean financial institutions; GMO Cybersecurity reported ARTEX infrastructure targeting Japanese companies.
• DIVD / Zammad: BleepingComputer, Help Net Security and others reported that the Dutch Institute for Vulnerability Disclosure was breached on September 21 by an AI-agent attack chaining two Zammad zero-days (CVE-2026-102489 and CVE-2026-102490). CISA added both to its Known Exploited Vulnerabilities catalog. Zammad disputes parts of DIVD’s disclosure, including affected versions. Reporting on whether this incident belongs to the Vapor Panda campaign has been unclear; one outlet explicitly states it does not, and CrowdStrike’s report does not tie Zammad to Vapor Panda.
• Unconfirmed: WorkOS said an attack it believes was ARTEX-driven reached an internal API on October 30, and 123 Reg said it suspects an ARTEX-linked China-nexus group. Neither has been tied to Vapor Panda.

Incident response and recovery status

Victim organizations have not been identified, so there is no public recovery status for the nine. What is public: CrowdStrike OverWatch observed the exploitation activity, CrowdStrike Intelligence published its report with nine indicators of compromise and 18 MITRE ATT&CK techniques, and the ARTEX developer has stopped public releases. CyberScoop reports the campaign remains active. Microsoft and Zscaler have separately published technical write-ups on Storm-0940.

Security recommendations

CrowdStrike’s published guidance includes rotating signing keys and credentials, enforcing SAML signature validation, requiring IMDSv2 and deploying real-time EDR. Expanding on that for IT and OT defenders:

1. Rotate and inventory long-lived secrets. Prioritize signing keys, API keys, service-account credentials and VPN client keys; treat anything from a known leak or older than your rotation policy as burned.
2. Enforce SAML assertion signature validation and test your service providers for unsigned-assertion acceptance and XXE.
3. Require IMDSv2 (or the equivalent) on cloud instances and restrict what roles reachable from metadata can do.
4. Remove unauthenticated management services from reachable networks, especially container orchestration and administration APIs.
5. Harden Active Directory: deploy and monitor LAPS, audit resource-based constrained delegation, and watch for unusual LAPS password reads.
6. Watch for high-volume authentication failures and low-and-slow spraying against SSO and mail; Microsoft’s Storm-0940 reporting describes both patterns.
7. Assume machine-speed lateral movement. Alert on rapid, multi-path activity from a single identity or host rather than relying on human-scale timing. Strengthen segmentation between enterprise IT and OT, and require MFA and brokered access for remote and vendor connections into OT.
8. Check EDR coverage gaps. The operator reportedly hunted for hosts without CrowdStrike Falcon; unmanaged Windows hosts are the first place agents will look.
9. Hunt for ARTEX artifacts. Third-party analysis (WindowsForum) lists the directory C:\ProgramData\artx5v, command lines containing artx or artex, and cloud roles prefixed artx as possible markers. Treat these as hunting leads, not confirmed signatures, and validate against CrowdStrike’s own IOC table.
10. Block and search for reported C2 domains: nginxmysql[.]com, sqlserver-sqlite[.]com and www[.]ddduuuppp[.]com (per CrowdStrike, as relayed by Unite.AI and Data Studios). Defang before sharing.
11. Patch KEV items: if you run Zammad, follow vendor and CISA guidance for CVE-2026-102489 and CVE-2026-102490.
12. Exercise AI-speed incident response: pre-authorize rapid credential revocation and tenant-wide session invalidation, and rehearse it.

Latest developments

• Oct 29: CrowdStrike publishes its Vapor Panda report.
• Oct 30: The Hacker News and other outlets amplify the findings; WorkOS discloses a suspected ARTEX-driven access.
• Nov 1-2: BleepingComputer, iTnews and others report the campaign and note GTIG and Mandiant’s observation that multiple groups, including financially motivated extortion crews, have used ARTEX in incident response cases since late August.
• Ongoing: no official government advisory specific to Vapor Panda’s ARTEX campaign was found in our research; check CISA and national CERTs. Chinese Foreign Ministry spokesperson Mao Ning has denied knowledge of related incidents, per The Record’s report on the Microsoft findings.