A China-linked hacking group known as VAPOR PANDA has used an AI-powered penetration testing framework called ARTEX to target more than 200 organizations worldwide. According to cybersecurity company CrowdStrike, the campaign began on October 17, 2026, and involved attacks across at least 14 countries. The targets included government departments, foreign ministries, telecommunications companies, pharmaceutical firms, semiconductor organizations, and defense-related institutions.
The attackers used ARTEX alongside DeepSeek, a Chinese-developed large language model, and another commercial AI model to automate different stages of their operations. ARTEX works through multiple AI agents that handle tasks such as planning, reconnaissance, identifying weaknesses, and moving through compromised networks. Instead of handling every step manually, the attackers could run several operations at the same time while a human operator provided instructions and guidance when needed.
CrowdStrike reported that the campaign affected organizations across Latin America, Europe, Asia, and the Middle East, along with several high-value targets in the United States. Its investigation confirmed post-exploitation activity at nine organizations, where attackers gained access, deployed malware, and carried out further activities involving credential attacks and network scanning. The group also targeted at least 12 additional organizations through password spraying and credential-scanning attempts.
One of the major findings was the use of a backdoor malware known as BLOODALCHEMY. CrowdStrike discovered that the attackers deployed this malware at a Middle Eastern interior ministry and a Latin American foreign ministry. The malware was delivered by disguising malicious files as legitimate system components, making them harder to identify. Researchers also found that the attackers instructed their AI agents to identify computers without CrowdStrike’s Falcon security software so they could focus their activities on systems with weaker protection.
The investigation also revealed how extensively the attackers relied on AI automation. During a single intrusion, ARTEX’s planning agents consumed approximately 1.4 billion input tokens. The framework allowed the attackers to investigate multiple systems, explore different attack methods, and switch approaches when an attempt failed. However, the operations were not completely independent, as a human operator continued to guide the AI agents and provide instructions throughout the process.
CrowdStrike has recommended that organizations regularly update and rotate their security credentials, signing keys, and authentication keys, including those stored in old backups. It also advised strengthening cloud security settings, patching internet-facing systems, and using endpoint detection and response solutions across organizational networks. This campaign highlights how AI-powered tools can make cyberattacks faster and easier to scale, allowing a relatively small group of attackers to target multiple organizations simultaneously.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
