Chinese hackers use ARTEX AI framework in automated attacks on more than 200 organizations

Chinese hackers used ARTEX, an open-source, multi-agent AI penetration-testing framework, in attacks against more than 200 organizations across 14 countries, according to researchers at CrowdStrike. The operation began on October 17 and targeted government ministries, telecommunications providers, and organizations in the pharmaceutical, semiconductor, defense, nuclear, and financial sectors. The threat actor, tracked by CrowdStrike as Vapor Panda, compromised at least nine organizations and carried out password spraying and credential scanning activity against at least 12 other high-value targets. Confirmed victims include telecommunications providers in the United States and Belgium, government organizations in Greece, the Middle East, and Latin America, and pharmaceutical firms in the United States. CrowdStrike said the "campaign marks an escalation in China-nexus use of AI agents, from single intrusions to multiple simultaneous engagements directed by a human operator." The researchers said the attackers issued instructions in Chinese and intervened at critical points where decisions needed to be made, while the AI agents performed reconnaissance, exploited vulnerabilities, deployed web shells, obtained credentials, and pursued alternative attack paths when needed. In the attack against the Greek government entity, the AI agents forged an administrator token and read mailboxes by leveraging authentication keys from a 2022 mail-server directory export, according to CrowdStrike. ARTEX AI is a penetration-testing suite developed by Chinese developers and initially released as an open-source project. Its creators later made the tool proprietary after it was used in real-world attacks, including a campaign against South Korean financial institutions. In the recent espionage operation, Vapor Panda also used DeepSeek and a second, unidentified commercial language model to coordinate planning and worker agents across multiple intrusions simultaneously. CrowdStrike believes the agents consumed more than 1.4 billion input tokens in one intrusion. The operators also explicitly instructed the agents to skip Windows machines protected by Falcon, CrowdStrike's endpoint protection product, and to focus on unprotected hosts. The researchers further found that the threat actor deployed BLOODALCHEMY, a backdoor active since 2023, against government entities in Latin America and the Middle East. Separately, the Dutch Institute for Vulnerability Disclosure (DIVD) has shared more details about the cyberattack it suffered in September 2026, which it attributed to an AI agent. According to its latest update, the tool used in the attack on its network was ARTEX AI, and it acted autonomously. In a post on LinkedIn, DIVD said the attack went from initial access to root privileges in 12 minutes, chaining a Zammad zero-day with a second zero-day for local privilege escalation. DIVD said the agent performed numerous tasks simultaneously, including reading a compromised mailbox, scanning the internal network, extracting login tokens, and attempting password resets. The organization recorded more than 450,000 requests and 2,500 scripts connected to the attack, describing the activity as "super loud and messy."