Chinese state-sponsored threat actors have been observed using a Go-based artificial intelligence (AI)-powered penetration testing framework called ARTEX in attacks aimed at high-value targets simultaneously.
The activity has been attributed by CrowdStrike to a China-based "targeted intrusion adversary" it tracks under the moniker Vapor Panda (previously VexatiousTemper). First identified in February 2021, the hacking group overlaps with a threat cluster detailed by Trend Micro as Earth Estries.
"Agentic tooling like ARTEX enables this scale of expansion at speed, allowing a small team to pursue a wider target set than manual operations would support, rather than a wholesale shift away from the adversary's established access-development mission," CrowdStrike said in a Thursday analysis.
Starting October 17, 2026, Vapor Panda is said to have used the AI tool against more than 200 distinct organizations across the world, including foreign ministries in Latin America, Europe, Asia, and the Middle East; semiconductor, defense, and think tank organizations in the U.S.; and telecommunications providers in multiple regions.
Some of the notable targets listed by CrowdStrike are listed below -
Post-exploitation activity has been confirmed at nine organizations, allowing the attacker to deploy BLOODALCHEMY, a derivative of ShadowPad, followed by credential spraying, network scanning, and reconnaissance.
Vapor Panda is also said to have conducted password-spraying and credential-scanning activity against at least 12 additional organizations, including U.S.-based think tanks and government entities in Europe.
Central to the operation is the use of ARTEX with DeepSeek and an as-yet-unknown, subscription-based commercial large language model (LLM) to conduct the intrusions at scale, leveraging an army of planner and worker agents that coordinate with each other in pursuit of a common goal to move from initial access to host reconnaissance and lateral movement.
Source link
