Overview
Chinese threat actors have used ARTEX, a multi-agent AI penetration-testing framework, to run largely automated intrusions against more than 200 organizations in 14 countries. CrowdStrike tracks the China-nexus actor as Vapor Panda. The Dutch Institute for Vulnerability Disclosure (DIVD) says it was itself breached by ARTEX AI in September 2026.
About ARTEX
ARTEX was built by Chinese developers and first released as open source. Its creators later made it proprietary after it was used in real attacks, including a campaign against South Korean financial institutions. Multiple AI agents cooperate: planning agents coordinate worker agents that carry out reconnaissance, exploitation, web shell deployment, and credential harvesting, and switch to alternative paths when blocked.
Operators issued instructions in Chinese, stepped in at key decision points, and used DeepSeek plus an unidentified commercial model for coordination. One intrusion reportedly consumed more than 1.4 billion input tokens.
Campaign Scale
- Start: October 17, 2026
- Reach: More than 200 organizations across 14 countries
- Compromised: At least nine organizations, with at least 12 further high-value targets hit by password spraying and credential scanning
- Sectors: Government ministries, telecoms, pharmaceuticals, semiconductors, defense, nuclear, and finance
- Confirmed victims: Telecom providers in the U.S. and Belgium, government entities in Greece, the Middle East, and Latin America, and U.S. pharmaceutical firms
CrowdStrike also observed the BLOODALCHEMY backdoor, active since 2023, used against government entities in Latin America and the Middle East.
Notable Incidents
Greek government: Agents forged an administrator token and read mailboxes using authentication keys recovered from a 2022 mail-server directory export. Stale exports left on disk became a direct path to compromise.
DIVD: Attackers went from initial access to root in 12 minutes, chaining a Zammad zero-day with a second zero-day for local privilege escalation. The agent read a compromised mailbox, scanned the internal network, extracted login tokens, and tried password resets. DIVD logged over 450,000 requests and 2,500 associated scripts, describing the activity as super loud and messy.
EDR evasion by instruction: Operators told the agents to avoid Windows machines protected by CrowdStrike Falcon and focus on unprotected hosts. Coverage gaps are therefore a targeting criterion.
Defensive Takeaways
The source reporting does not list formal mitigations, but its details point to clear priorities:
- Close endpoint coverage gaps. Unmanaged or unprotected hosts are being deliberately selected.
- Purge old secrets. Delete stale directory and mail-server exports, and rotate any keys that may have been exposed.
- Reduce internet-facing zero-day exposure. Minimize and segment exposed services such as ticketing and helpdesk platforms.
- Detect noisy automation. AI-driven intrusions generate high request volumes; rate limiting and anomaly alerting can catch them early.
- Defend against password spraying with MFA and lockout or smart-throttling policies.