Chinese state-sponsored hackers linked to a group called Vapor Panda have launched widespread attacks using an artificial intelligence-powered tool named ARTEX, targeting more than 200 organizations worldwide. The campaign, which began on October 17, 2026, and ran over an 11-day window across at least 14 countries, has targeted foreign ministries across multiple continents, U.S. semiconductor and defense companies, telecommunications providers, and various government entities. Security firm CrowdStrike, which tracks the group, confirmed post-exploitation activity at nine organizations, where the attackers installed the BLOODALCHEMY backdoor and moved on to credential spraying, network scanning, and reconnaissance. The 200-plus figure counts organizations targeted, not confirmed breaches.
ARTEX, originally released as an open-source penetration-testing tool for security teams, uses artificial intelligence agents to automate hacking processes, significantly reducing the technical skill required to conduct large-scale intrusions. A main agent coordinates “planner” agents that decide what to try next and “worker” agents that carry it out, sharing findings as they go. Vapor Panda ran the tool primarily on the Chinese AI model DeepSeek, along with a second commercial model, with a human operator directing the agents in Chinese. During a single intrusion, the planning agents consumed approximately 1.4 billion input tokens, demonstrating the extensive scale of automated activity. The tool lets a small team pursue many targets in parallel, and the operator also directed the agents to evade endpoint security defenses.
Source: Read the full story at The Hacker News · CrowdStrike’s original report
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
