Talos tracks criminal and China-nexus use of ARTEX pentest framework
Original title: ARTEX and beyond: AI-enabled penetration testing platforms
CrowdStrike says China-nexus VAPOR PANDA used ARTEX against more than 200 organizations in at least 14 countries.
Cisco Talos says AI penetration-testing frameworks, including ARTEX, are automating attack chains in real intrusions. ARTEX, published on GitHub in July 2026 under the name Autumn-27, uses planner and worker agents and can be extended via MCP to tools such as VShell, GoPhish and AdaptixC2. CrowdStrike and Microsoft link recent use to VAPOR PANDA and Storm-0940, with results from failed attempts to confirmed data theft. Talos also found more than 700 reachable PentAGI instances.
Unconfirmed: Campaign scope and China-nexus labels come from CrowdStrike and Microsoft reporting, not fully independent Talos confirmation.
- VAPOR PANDA targeted more than 200 organizations in at least 14 countries.
- CrowdStrike confirmed post-compromise activity at nine of those organizations.
- Storm-0940 tried sign-ins against more than 2,250 Microsoft 365 tenants.
- Reported targets included finance, telecom, defense, pharma and government.
- Talos says ARTEX is used by criminals and China-nexus actors.
Impact: Automated intrusion, credential abuse and data exfiltration
- Threat actors
- VAPOR PANDAStorm-0940
- Organizations
- Cisco TalosCrowdStrikeMicrosoft
- Countries
- China
From the original article
11 min read at blog.talosintelligence.com
AI-enabled penetration testing and red team frameworks can automate and chain reconnaissance, vulnerability testing, and follow-on actions, lowering the skill threshold for attackers and accelerating intrusions when the tools are misused.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.