Skip to content
NewA calmer, faster ZeroHour
StoryThreat actorcriticalExploited in the wild

China-Linked Group Uses ARTEX AI Against 200 Targets

5 sources · 5 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Vapor Panda used ARTEX AI framework with DeepSeek to compromise over 200 organizations in 14 countries since October 17, 2026, confirming post-exploitation at nine sites.

A China-linked group tracked as Vapor Panda employed the Go-based ARTEX AI penetration framework, integrated with DeepSeek and a commercial LLM, in a campaign against more than 200 organizations across at least 14 countries beginning October 17, 2026. Targets encompassed foreign ministries, telecom providers in the US, Belgium and Philippines, and entities in US defense, semiconductor, nuclear, pharmaceutical and financial sectors, including a European presidency office. Post-exploitation activity confirmed at nine organizations with BLOODALCHEMY backdoor deployment, alongside password spraying against at least 12 others. The effort was separate from Microsoft's attribution of ARTEX to Storm-0940.

Key facts
  • Vapor Panda targeted over 200 organizations in 14 countries since October 17, 2026
  • ARTEX AI framework used with DeepSeek and commercial LLM
  • Post-exploitation confirmed at nine sites with BLOODALCHEMY backdoor
  • Password spraying hit at least 12 high-value targets
  • AI agents issued over 1,500 commands per hour
  • Campaign separate from Microsoft Storm-0940 ARTEX activity
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 17, 2026Vapor Panda launched ARTEX AI campaign against 200+ organizations · CrowdStrike via The Hacker News, CyberScoop

What each outlet adds

beyond the shared facts
  • The Hacker NewsDetails 1.4 billion input tokens used, SAML/XXE chaining, Li Puhua closed ARTEX source
  • CyberScoop140 sensitive targets compromised in 11 days, 70% at moderate-high confidence, 1,500 commands/hour
  • BleepingComputerAI forged admin token in Greek government entity, BLOODALCHEMY in Latin America/Middle East
  • CSO OnlineAI agents checked for CrowdStrike Falcon sensor presence
  • Help Net SecuritySimilar CyberStrikeAI campaign, 3-4 days to domain admin compromise, recommend key rotation
Vendors
CrowdStrikeKasperskyMicrosoft
Products
ARTEXCyberStrikeAIARTEX AIFalcon
Threat actors
Vapor PandaEarth EstriesHollow PandaOvercast PandaTitan PandaVeiled PandaVAPOR PANDAStorm-0940
Malware
ARTEXBLOODALCHEMYShadowPadFlowCloudBloodAlchemy
Victims
foreign ministries in Latin AmericaEuropeAsia and the Middle EastUS defense and semiconductor companiesand telecom providerseducational institutions in Africa and Latin Americagovernment agenciespharmaceutical companies
Organizations
CrowdStrikeTrend MicroZscalerHFS ResearchOmdiaKanerika
Countries
ChinaUnited StatesBelgiumPhilippinesLatin AmericaEuropeAsiaMiddle EastAfricaUS14
AI models
DeepSeek

Coverage

oldest first · one row per article · UTC
  1. · 4d ago The Hacker NewsFirst report

    CrowdStrike: Vapor Panda used ARTEX against over 200 organizations

    From October 17 the China-linked group hit ministries, telecoms, and U.S. defense-related targets; post-exploitation is confirmed at nine.

  2. · 4d ago CyberScoop

    Vapor Panda used agentic AI tool ARTEX against about 140 targets

    CrowdStrike says the China-linked campaign has hit more than 200 organizations in at least 14 countries since October 17.

  3. · 1d ago BleepingComputer

    Chinese hackers use ARTEX AI in automated attacks against 200 orgs

    Vapor Panda employed the ARTEX AI framework to conduct simultaneous intrusions across more than 200 organizations in 14 countries.

  4. · 19h ago CSO Online

    China-linked group uses AI to target endpoint security

    VAPOR PANDA targeted over 200 organizations with ARTEX AI agents in 11 days, confirming post-exploitation at nine sites.

  5. · 17h ago Help Net Security

    Chinese-linked groups use AI agents to attack over 200 organizations in 11 days

    CrowdStrike reports China-nexus group Vapor Panda used ARTEX AI framework to attack organizations in 14 countries, installing BloodAlchemy backdoor.