Chinese Hackers Weaponize ARTEX AI For Automated Attacks

Chinese threat actors have adopted ARTEX, an AI-driven penetration testing framework, to automate intrusions against government agencies, banks, and private companies across multiple continents. CrowdStrike now links the espionage group VAPOR PANDA to a campaign that used the tool against more than 200 organizations in at least 14 countries.

Separate reports link the framework to breaches at South Korean banks, while a Dutch security nonprofit suffered an intrusion carried out by an autonomous AI agent. Together, these incidents show how AI agents now let small teams run fast, parallel attacks that once required large groups of skilled human operators.

CrowdStrike OverWatch spotted the VAPOR PANDA campaign on October 17, 2026, when a single ARTEX controller began targeting entities across at least 14 countries. The controller, which CrowdStrike linked to the VAPOR PANDA infrastructure, periodically exposed tooling, target files, and agent transcripts, revealing several simultaneous engagements over 11 days.

Victims included foreign ministries in Latin America, Europe, Asia, and the Middle East, as well as U.S. semiconductor, defense, and think tank organizations. The attackers also compromised telecommunications providers in the United States, Belgium, and the Philippines, as well as an interior ministry in the Middle East.

One engagement focused on a single European nation, targeting its foreign ministry, presidency, and prime minister's office, as well as defense, justice, finance, and intelligence bodies. Another engagement targeted 19 U.S. organizations operating in the pharmaceutical, semiconductor, defense, nuclear, and financial sectors, indicating a notable expansion of the group's interests.

CrowdStrike confirmed post-exploitation activity across nine organizations, in which attackers deployed the BLOODALCHEMY backdoor and conducted credential spraying, network scanning, and reconnaissance. The group also launched password-spraying and credential-scanning attempts against at least 12 more organizations, including U.S. think tanks and European government entities.

How ARTEX Runs Parallel Intrusions

ARTEX coordinates a main agent with subordinate planner and worker agents, which share a common graph of facts, findings, and goals during each engagement. VAPOR PANDA powered the framework mainly with the Chinese DeepSeek model and supplemented it with a second subscription-based commercial LLM that CrowdStrike could not identify. In just one intrusion, the planning agents consumed roughly 1.4 billion input tokens, suggesting far greater consumption across the entire operation. A human operator still steered the agents, issuing Chinese-language instructions at key decision points while the AI handled most of the technical work.

The agents pursued several attack paths at once, spanning web applications, cloud services, container environments, Active Directory, and mail and VPN infrastructure. When one path failed, the agents switched to alternative approaches, which allowed a single operator to pressure more targets than manual hacking would have allowed. Recovered transcripts show the agents combining automated workflows with established tradecraft, and CrowdStrike highlighted several examples of this approach in its report:

• At a U.S. pharmaceutical firm, the agent chained an unsigned SAML assertion with an XXE flaw to query cloud metadata and seize administrative control.
• At a second pharmaceutical company, the agent deployed web shells, gained root access to production containers, and read passwords from the Local Administrator Password Solution.
• Against a Greek government entity, the agent used unrotated keys from a 2022 mail server export to forge an administrator token and read mailboxes.

VAPOR PANDA also built endpoint evasion directly into its agentic workflow, instructing agents to locate hosts without the CrowdStrike Falcon sensor. At one pharmaceutical organization, the operator told the agents to "find Windows machines in the domain without Falcon," according to CrowdStrike's translation.

This tactic lets attackers concentrate follow-on activity on unprotected machines, reducing the likelihood that security tools will detect their movements. In two ministries, the group loaded BLOODALCHEMY via a renamed GameHook binary that posed as svchost.exe, which then sideloaded a malicious DLL to decrypt the payload.

Earlier in October, a Chinese-speaking hacker used ARTEX and Claude agents to attack South Korean banks, including Shinhan Bank, KB Kookmin Bank, and Hana Bank. The attacks exposed customers' personal data and credit card information, caused outages at some institutions, and prompted the government to hold an emergency meeting.

CrowdStrike researchers traced the attacker's infrastructure and found open directories holding Claude Code session histories, ARTEX configuration files, and Claude memory files. The ARTEX instance relied on DeepSeek v4.1-flash as its main LLM, while the attacker also ran Claude Code sessions through GLM-5.3 and Grok 4.6.

The records matched targets named in earlier reports on financial sector breaches, allowing CrowdStrike to link the activity with high confidence. The attacker also used the same AI tools to write a résumé, which exposed identification details, contact information, and a Telegram account.

Based on that résumé, CrowdStrike believes the hacker may be a 26-year-old former student of the South China University of Technology living in Maoming, Guangdong. However, the researchers caution that conflicting birth dates render these personal details too unreliable to confirm the threat actor's identity. The logs also show the hacker had no clear plan to monetize the stolen data and asked Claude to suggest Korean-focused Telegram data-sales groups.

After confirming that threat actors had used ARTEX in real-world attacks, the developer switched the project to closed-source and stopped releasing further updates. However, others had already translated the existing code into English and Korean, so the framework remains freely available in its current form.

CrowdStrike notes that VAPOR PANDA's campaign is separate from the ARTEX activity Microsoft attributes to Storm-0940, a group behind the ConnectWise supply chain attack. This pattern suggests the framework is quickly gaining popularity among multiple China-nexus adversaries, and CrowdStrike expects the trend to continue over the next 12 months.

AI agents also threaten defenders themselves, as the Dutch Institute for Vulnerability Disclosure (DIVD) discovered when an autonomous agent breached its network in September. The volunteer-run nonprofit scans the internet for vulnerable systems and alerts their owners, and it had operated for seven years without a single breach.

The attacker exploited a technical vulnerability in an undisclosed system, which DIVD said was not Citrix NetScaler, and then unleashed an AI agent for post-exploitation. DIVD described the intrusion as "loud and very, very messy," noting that the agent chose each next step at extreme speed but with sloppy logic.

The agent even sabotaged its own adversary-in-the-middle attack by launching password spraying and over-explaining every decision in its comments. DIVD believes the attacker poorly trained and configured the agent, which left behind enough evidence for investigators to reconstruct what happened. The organization informed the police, the Dutch data protection authority, and the National Cyber Security Center, and it plans to warn other potential victims.