Vapor Panda used agentic AI tool ARTEX against about 140 targets
Original title: China-backed threat group used agentic AI pentesting tool to compromise 140 sensitive targets in 11 days
CrowdStrike says the China-linked campaign has hit more than 200 organizations in at least 14 countries since October 17.
CrowdStrike says the China state-backed group it tracks as Vapor Panda is using the automated agentic penetration-testing framework ARTEX, paired with DeepSeek, in an active campaign. Since October 17 the group targeted more than 200 organizations; about 140 sensitive targets were compromised in 11 days, CrowdStrike told CyberScoop. About 70% of targets were confirmed compromised or assessed at moderate confidence. CrowdStrike says this activity is separate from Microsoft’s earlier ARTEX attribution to Storm-0940.
Unconfirmed: Compromise totals and China state backing are CrowdStrike assessments, and some intrusions are only moderate confidence.
- Victims include foreign ministries, a European presidency and prime minister’s office, and defense and intelligence agencies.
- Nineteen U.S. organizations in pharma, semiconductors, defense, nuclear and finance were among targets.
- Telecom providers in the United States, Belgium and the Philippines were also targeted.
- CrowdStrike says ARTEX activity exceeded 1,500 commands an hour versus up to 40 historically.
- It counted about 45 agentic-adversary attacks in September and 126 in October so far.
Impact: Intrusions at government, defense, intelligence and industry targets
- 1.Gain visibility into endpoints, identities and cross-domain activity, CrowdStrike’s Meyers said.
- ATT&CK
- T1505.003 Web Shell
- Threat actors
- Vapor Panda
- Malware
- ARTEX
- Organizations
- CrowdStrike
- Countries
- ChinaUnited StatesBelgiumPhilippines
- AI models
- DeepSeek
From the original article
3 min read at cyberscoop.com
Vapor Panda targeted more than 200 organizations spanning at least 14 countries, according to CrowdStrike. The ongoing campaign is remarkably successful and operating at shocking speed. The post China-backed threat group used agentic AI pentesting tool to compromise 140 sensitive targets in 11 days appeared first on CyberScoop.
By Matt Kapko · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.