A Chinese threat actor used ARTEX, an open-source, multi-agent AI penetration-testing framework, in a campaign targeting more than 200 organizations across 14 countries, according to CrowdStrike researchers. The operation began on October 17 and focused on government ministries, telecommunications providers and organizations in sectors including pharmaceuticals, semiconductors, defense, nuclear energy and finance.
The researchers attribute the campaign to a group they track as Vapor Panda. At least nine organizations were compromised, while password-spraying and credential-scanning activity targeted at least 12 other high-value entities. Confirmed victims include telecommunications providers in the United States and Belgium, government organizations in Greece, the Middle East and Latin America, and pharmaceutical companies in the U.S.
CrowdStrike described the operation as an escalation in the use of AI agents by China-linked actors: rather than handling a single intrusion, agents were directed by a human operator across multiple engagements at the same time. The operators issued instructions in Chinese and stepped in at key decision points. The agents conducted reconnaissance, exploited vulnerabilities, deployed web shells, sought credentials and tried alternative attack paths.
In an attack on a Greek government organization, the agents forged an administrator token and accessed mailboxes using authentication keys obtained from a 2022 mail-server directory export. Operators also told the agents to avoid Windows machines protected by CrowdStrike’s Falcon endpoint security product and concentrate on unprotected hosts. In one intrusion, researchers estimate that the agents processed more than 1.4 billion input tokens.
Vapor Panda used DeepSeek and another, unidentified commercial language model to coordinate planning and agent activity. The group also deployed BLOODALCHEMY, a backdoor active since 2023, against government entities in Latin America and the Middle East.
ARTEX was developed by Chinese developers and initially released as an open-source project. Its creators later made it proprietary after the framework was used in real-world attacks, including a campaign against South Korean financial institutions.
A separate incident at the Dutch Institute for Vulnerability Disclosure (DIVD) has also been linked to ARTEX AI. The institute said the agent acted autonomously during a September 2026 attack, moving from initial access to root privileges in 12 minutes by chaining a Zammad zero-day vulnerability with a second flaw for local privilege escalation.
DIVD reported that the agent read a compromised mailbox, scanned the internal network, extracted login tokens and attempted password resets. The institute recorded more than 450,000 requests and 2,500 scripts related to the activity.
Sources: BleepingComputer.