ARTEX AI attacks target over 200 organisations

ARTEX AI attacks targeted more than 200 organisations across 14 countries in a campaign that began on October 17. CrowdStrike researchers attributed the operation to a China-linked group called Vapor Panda, which compromised at least nine organisations.

Vapor Panda targets government and industry

The campaign targeted government ministries, telecommunications providers and organisations across the pharmaceutical, semiconductor, defence, nuclear and financial sectors. Confirmed victims included telecoms companies in the United States and Belgium, alongside American pharmaceutical firms. Government organisations in Greece, the Middle East and Latin America also suffered compromises.

In addition, the attackers conducted password spraying and credential scanning against at least 12 other high-value targets. CrowdStrike described the campaign as an expansion of China-linked AI operations into multiple simultaneous intrusions. However, human operators continued to direct the activity and intervene at important decision points.

During the intrusion into a Greek government organisation, agents reportedly used authentication keys from a 2022 mail-server directory export. They then forged an administrator token and accessed mailboxes. Separately, researchers found the BLOODALCHEMY backdoor in attacks against government entities in Latin America and the Middle East.

AI agents coordinate simultaneous intrusions

ARTEX began as an open-source penetration-testing framework developed by Chinese developers. Its creators later made it proprietary following its use in real-world attacks. Those incidents included an earlier campaign targeting South Korean financial institutions.

For the latest ARTEX AI attacks, Vapor Panda also used DeepSeek and an unidentified commercial language model. Together, these tools supported planning and worker agents across several intrusions at once. Meanwhile, the operators issued instructions in Chinese and stepped in when the agents required direction.

The agents performed reconnaissance, exploited vulnerabilities, deployed web shells and obtained credentials. They also explored alternative routes when an attack path failed. According to CrowdStrike’s estimate, one intrusion consumed more than 1.4 billion input tokens.

Operators specifically instructed the agents to avoid Windows systems running CrowdStrike’s Falcon endpoint protection software. Instead, they directed attention towards unprotected hosts. The instruction shows how the attackers adjusted their targeting, although it does not establish that every protected system would have resisted compromise.

Separate DIVD incident reveals rapid escalation

The Dutch Institute for Vulnerability Disclosure has also identified ARTEX as the tool behind its September 2026 breach. According to the organisation, an autonomous agent moved from initial access to root privileges in 12 minutes. It chained a Zammad zero-day vulnerability with a second zero-day that enabled local privilege escalation.

During that incident, the agent handled several tasks simultaneously. These included reading a compromised mailbox, scanning the internal network, extracting login tokens and attempting password resets. Consequently, the intrusion generated substantial activity across the environment.

DIVD recorded more than 450,000 requests and 2,500 scripts associated with the attack. Despite its speed, the organisation described the operation as noisy and disorganised. The disclosure adds another documented example of ARTEX AI attacks, but the supplied findings do not link the DIVD breach to Vapor Panda.