Chinese hackers use AI agent ARTEX to target 200 global organizations

A Chinese state-sponsored hacking group known as Vapor Panda has launched a large-scale cyberespionage campaign using an artificial intelligence-powered penetration testing framework called ARTEX. Since October 17, 2026, the group has targeted more than 200 organizations globally, leveraging automated agents to conduct simultaneous intrusions with minimal human intervention.

What happened

CrowdStrike identified the activity and attributed it to Vapor Panda, a threat actor previously tracked as VexatiousTemper and overlapping with the Earth Estries cluster. The campaign focuses on high-value targets, including foreign ministries in Latin America, Europe, Asia, and the Middle East. In the United States, the group targeted 19 organizations across the pharmaceutical, semiconductor, defense, nuclear, and financial sectors, as well as telecommunications providers in the U.S., Belgium, and the Philippines.

Post-exploitation activity was confirmed at nine organizations, where attackers deployed BLOODALCHEMY, a derivative of the ShadowPad malware. This was followed by credential spraying, network scanning, and reconnaissance. Additionally, Vapor Panda conducted password-spraying and credential-scanning against at least 12 other entities, including U.S.-based think tanks and European government bodies. The scale of the operation is driven by ARTEX, a Go-based framework that allows a small team to manage a much wider target set than manual operations would permit.

How it works

ARTEX operates by orchestrating multiple large language model (LLM) backends, including DeepSeek and an unknown commercial subscription-based LLM. It employs a system of planner and worker agents that coordinate to move from initial access to host reconnaissance and lateral movement. A human operator remains in the loop, steering the agents to write web shells, extract domain administrator passwords, and enumerate endpoint sensor coverage. In a single intrusion, planning agents consumed approximately 1.4 billion input tokens, highlighting the extensive automation involved.

The framework combines AI autonomy with established exploitation techniques. For example, it chains unsigned Security Assertion Markup Language (SAML) assertions with XML external entity (XXE) flaws to query cloud Instance Metadata Services. It also abuses unauthenticated orchestration services to gain root access in container environments and leverages resource-based constrained delegation to impersonate privileged accounts. When one attack path fails, the agents automatically shift to alternative methods, spanning web applications, cloud services, Active Directory, and VPN infrastructure.

Key details

• Threat Actor: Vapor Panda (aka VexatiousTemper), a China-based targeted intrusion adversary first identified in February 2021.
• Tool: ARTEX, a Go-based AI penetration testing framework developed by Li Puhua ("Autumn-27"), now closed source.
• Scale: Over 200 distinct organizations targeted starting October 17, 2026, across government, defense, telecom, and tech sectors.
• Mechanism: Uses planner and worker agents powered by DeepSeek and a commercial LLM to automate reconnaissance and exploitation.
• Malware: Deploys BLOODALCHEMY, a ShadowPad derivative, for post-exploitation activities like credential harvesting and lateral movement.
• Token Usage: Planning agents consumed around 1.4 billion input tokens in a single intrusion, indicating massive automated activity.

Why it matters

This campaign demonstrates a significant shift in how state-sponsored actors conduct cyberespionage. By using agentic AI tools like ARTEX, adversaries can lower the technical barrier for complex intrusions and operate at a speed and scale previously unattainable. A single operator can now manage multiple concurrent engagements, applying a broad range of techniques across different infrastructure types without being bottlenecked by manual execution. This efficiency allows small teams to pursue a wider array of targets simultaneously, increasing the risk for organizations that may not expect such sophisticated, automated attention.

For software developers and security engineers, the use of AI to chain vulnerabilities and bypass defenses highlights the need for robust automated security controls. The attackers’ ability to pivot between failed and successful attack paths in real-time means that static defenses are insufficient. Organizations must assume that attackers can rapidly adapt their tactics using AI assistance, making continuous monitoring and rapid response critical to detecting and stopping intrusions before data exfiltration occurs.

What you can do

• Rotate all authentication keys and credentials immediately, especially those older than two years, to prevent token forgery.
• Audit cloud configurations for unsigned SAML assertions and XXE vulnerabilities to block metadata service queries.
• Implement strict access controls for orchestration services to prevent unauthorized root access in container environments.
• Monitor for unusual LLM token consumption patterns or automated behavioral signatures in network traffic.
• Enforce multi-factor authentication and restrict lateral movement capabilities within Active Directory and VPN infrastructure.
• Update and patch legal billing software and IIS servers to mitigate hardcoded machine key vulnerabilities exploited by related groups.