Chinese hackers conducted a large-scale cyberattack campaign using ARTEX, an AI penetration-testing framework, against more than 200 organizations across 14 countries beginning in October. The operation targeted government ministries, telecommunications providers, and companies in the pharmaceutical, semiconductor, defense, nuclear, and financial sectors. Researchers at CrowdStrike identified the threat actor as Vapor Panda and confirmed that the group compromised at least nine organizations while conducting password spraying and credential scanning against twelve additional high-value targets.
The campaign represented a significant escalation in AI-assisted cyberattacks, with human operators directing multiple simultaneous intrusions. Vapor Panda employed ARTEX alongside DeepSeek and another commercial language model to coordinate reconnaissance, vulnerability exploitation, web shell deployment, and credential theft. The attackers specifically instructed AI agents to avoid systems protected by certain endpoint security solutions and concentrated on unprotected hosts. CrowdStrike also found that the group deployed BLOODALCHEMY, a backdoor active since 2023, against government entities in Latin America and the Middle East.
Source: Read the full story at BleepingComputer
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
