CrowdStrike: Vapor Panda used ARTEX against over 200 organizations
Original title: Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide
From October 17 the China-linked group hit ministries, telecoms, and U.S. defense-related targets; post-exploitation is confirmed at nine.
CrowdStrike says China-based Vapor Panda, overlapping Trend Micro's Earth Estries, used the Go-based AI penetration framework ARTEX with DeepSeek and an unnamed commercial LLM against more than 200 organizations starting October 17, 2026. Targets included foreign ministries, U.S. semiconductor, defense, nuclear, pharmaceutical, and financial organizations, and telecom providers in the U.S., Belgium, and the Philippines. Post-exploitation is confirmed at nine organizations, including BLOODALCHEMY, a ShadowPad derivative, plus credential spraying and reconnaissance. CrowdStrike also described four additional China-linked clusters, including Overcast Panda's FlowCloud close-access intrusions.
Unconfirmed: Attribution to Vapor Panda and the scale of the campaign are CrowdStrike's assessment.
- Planning agents used about 1.4 billion input tokens in one intrusion, CrowdStrike said.
- Password spraying hit at least 12 further organizations.
- Intrusions chained unsigned SAML and XXE, web shells, LAPS passwords, and unrotated keys.
- ARTEX developer Li Puhua later took the tool closed source, Zscaler said.
Impact: Intrusion, credential theft, web shells, and host reconnaissance
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1110.003 Password SprayingT1505.003 Web ShellT1550 Use Alternate Authentication Material
- Organizations
- CrowdStrikeTrend MicroZscaler
- Countries
- ChinaUnited StatesBelgiumPhilippines
- AI models
- DeepSeek
From the original article
5 min read at thehackernews.com
Chinese state-sponsored threat actors have been observed using a Go-based artificial intelligence (AI)-powered penetration testing framework called ARTEX in attacks aimed at high-value targets simultaneously. The activity has been attributed by CrowdStrike to a China-based "targeted intrusion adversary" it tracks under the moniker Vapor Panda (previously VexatiousTemper). First identified in
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.