China-linked Vapor Panda uses AI-powered ARTEX tool to hit over 200 organizations

A China-linked threat group used an AI-powered offensive framework to target more than 200 organizations around the world, according to new research from CrowdStrike reported by The Hacker News on October 30, 2026. The group, tracked as Vapor Panda (previously VexatiousTemper), is described as a China-based state-sponsored intrusion actor first identified in February 2021.

What happened

According to The Hacker News, Vapor Panda began using a tool called ARTEX against distinct organizations starting October 17, 2026. Zscaler ThreatLabz, cited in the report, describes ARTEX as a Go-based, AI-powered penetration testing framework that 'orchestrates multiple LLM backends to autonomously perform reconnaissance, vulnerability identification, and exploitation.' The Hacker News, citing a Wall Street Journal report, says the tool's developer took it closed source after it was widely adopted by threat actors.

Technical details

The Hacker News, citing CrowdStrike, says ARTEX was operated with the DeepSeek model and an unidentified subscription-based commercial LLM, using a 'planner and worker' agent architecture that coordinates toward a shared objective, from initial access through host reconnaissance and lateral movement. A human operator oversaw the campaign and directed agents to write web shells, extract domain administrator passwords, and enumerate which endpoints were covered by security sensors. When one attack path failed, the report says agents pursued alternatives in parallel across web, cloud, container, Active Directory, mail and VPN environments. In one intrusion, planning agents alone consumed roughly 1.4 billion input tokens, which CrowdStrike says implies far higher total consumption across the operation.

Who is affected

The Hacker News reports that targets spanned government and foreign-affairs bodies in Latin America, Europe, Asia and the Middle East, including a European country's foreign ministry, presidency, prime minister's office and its defense, justice, finance and intelligence entities. In the United States, 19 organizations across the pharmaceutical, semiconductor, defense, nuclear and financial sectors were targeted, along with think tanks. Telecommunications providers in the U.S., Belgium, the Philippines and other regions were also hit. According to CrowdStrike, post-exploitation activity was confirmed at nine organizations, where the attackers deployed BLOODALCHEMY, described as a derivative of the ShadowPad backdoor, and carried out credential spraying, network scanning and reconnaissance. At least 12 more organizations, including U.S. think tanks and European government entities, faced password spraying and credential scanning. The report notes Vapor Panda's activity overlaps with the Earth Estries cluster detailed by Trend Micro.

What to do

The automation on display raises the speed and breadth of intrusions, but the underlying techniques remain familiar. Based on the TTPs described, defenders should enforce strict validation of SAML assertions, rotate long-lived keys and secrets, and require protected cloud metadata access (such as IMDSv2). Audit LAPS access and delegation settings in Active Directory, disable external entity processing in XML parsers, and lock down unauthenticated orchestration APIs. Because the agents enumerate sensor coverage to find gaps, organizations should verify that endpoint detection is deployed everywhere and watch for bursts of credential spraying and high-volume automated administrative actions.