Chinese hackers used ARTEX, an open-source, multi-agent AI penetration-testing framework, in attacks against more than 200 organizations across 14 countries.

The operation began on October 17 and targeted government ministries, telecommunications providers, and organizations in the pharmaceutical, semiconductor, defense, nuclear, and financial sectors.

The threat actor compromised at least nine organizations and carried out password spraying attacks and credential scanning activity against at least 12 other high-value targets.

According to researchers at CrowdStrike, the "campaign marks an escalation in China-nexus use of AI agents, from single intrusions to multiple simultaneous engagements directed by a human operator."

Confirmed victims include telecommunications providers in the United States and Belgium, government organizations in Greece, the Middle East, and Latin America, and pharmaceutical firms in the U.S.

The researchers track the threat actor as Vapor Panda and say that in the attack against the Greek government entity, the AI agents forged an administrator token and read mailboxes by leveraging authentication keys from a 2022 mail-server directory export.

ARTEX AI is a penetration testing suite developed by Chinese developers and initially released as an open-source project. However, its creators later made it proprietary after it was used in real-world attacks, including a campaign against South Korean financial institutions.

In its most recent cyberespionage operation, Vapor Panda also used DeepSeek and a second, unidentified commercial language model to coordinate planning and worker agents across multiple intrusions simultaneously.

CrowdStrike says the attackers issued instructions in Chinese and intervened at critical points where decisions needed to be made.

The AI agents performed reconnaissance, exploited vulnerabilities, deployed web shells, obtained credentials, and pursued alternative attack paths when needed.

The operators explicitly instructed the agents to skip Windows machines protected by Falcon, CrowdStrike's solution for endpoint protection, and focused on unprotected hosts.

In one intrusion, the AI agents consumed more than 1.4 billion input tokens, the researchers believe.

CrowdStrike also found that the threat actor deployed BLOODALCHEMY, a backdoor active since 2023, against government entities in Latin America and the Middle East.

More ARTEX AI cases emerge

The Dutch Institute for Vulnerability Disclosure (DIVD) has shared more details about the cyberattack it suffered in September 2026, which it attributed to an AI agent.

According to its latest update, the tool used in the attack on its network was ARTEX AI, which acted autonomously.

DIVD explained in a post on LinkedIn that the attack went from initial access to root privileges in 12 minutes, chaining a Zammad zero-day with a second zero-day for local privilege escalation.

The agent performed numerous tasks simultaneously, including reading a compromised mailbox, scanning the internal network, extracting login tokens, and attempting password resets.

DIVD recorded over 450,000 requests and 2,500 scripts connected to the attack, describing the activity as “super loud and messy.”

Uncover email threats your existing defenses may miss.

Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.

See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.

Start your free email security scan.