A Chinese-linked threat actor designated Vapor Panda has leveraged ARTEX, an open-source multi-agent AI penetration-testing framework, to conduct coordinated attacks against more than 200 organizations distributed across 14 countries. The campaign initiated on October 17, focusing on government ministries, telecommunications operators, and entities in pharmaceutical, semiconductor, defense, nuclear, and financial industries.
Researchers at CrowdStrike documented that the threat actor successfully compromised at least nine organizations while executing password spraying and credential scanning operations against a minimum of 12 additional high-value targets. According to the security firm, this represents "an escalation in China-nexus use of AI agents, from single intrusions to multiple simultaneous engagements directed by a human operator."
Confirmed victims encompass telecommunications providers in the United States and Belgium, government organizations spanning Greece, the Middle East, and Latin America, and pharmaceutical companies based in the U.S. In one intrusion targeting a Greek government entity, the AI agents fabricated an administrator token and accessed mailboxes by exploiting authentication keys obtained from a 2022 mail-server directory export.
ARTEX origins and evolution
ARTEX AI originated as an open-source penetration testing suite developed by Chinese programmers. The creators transitioned the project to proprietary status following its deployment in real-world attacks, notably including operations against South Korean financial institutions.
AI coordination and operational tactics
In the latest cyberespionage campaign, Vapor Panda orchestrated operations using ARTEX AI alongside DeepSeek and an unnamed commercial language model to synchronize planning and worker agents across multiple simultaneous intrusions. Human operators issued instructions in Chinese and made critical decisions at key junctures throughout the attacks.
The AI agents executed reconnaissance activities, identified and exploited vulnerabilities, installed web shells, harvested credentials, and adapted attack strategies when encountering obstacles. Notably, the operators explicitly directed the agents to avoid Windows systems running Falcon, CrowdStrike's endpoint protection platform, and instead concentrated efforts on undefended infrastructure. One intrusion consumed over 1.4 billion input tokens, according to CrowdStrike's analysis.
CrowdStrike also identified deployment of BLOODALCHEMY, a backdoor operational since 2023, targeting government entities in Latin America and the Middle East during this campaign.
Additional ARTEX AI incidents documented
The Dutch Institute for Vulnerability Disclosure (DIVD) released additional information regarding a cyberattack it experienced in September 2026, which it attributed to autonomous AI agent activity. The organization confirmed that ARTEX AI was the tool deployed in the intrusion.
According to DIVD's LinkedIn post, the attack progressed from initial network access to root-level privileges within 12 minutes by chaining a Zammad zero-day vulnerability with a second zero-day enabling local privilege escalation. The agent executed multiple concurrent operations including mailbox compromise, internal network reconnaissance, login token extraction, and attempted password resets.
DIVD documented over 450,000 requests and 2,500 scripts associated with the attack, characterizing the activity as "super loud and messy."