GoKawiilCrowdStrike: China-linked Vapor Panda used ARTEX AI to hit 200+ organizations
CrowdStrike reports that a China-nexus threat actor it tracks as Vapor Panda used the ARTEX AI penetration-testing framework, alongside DeepSeek and another commercial language model, to target over 200 organizations in 14 countries starting October 17. The campaign hit government ministries, telecoms, pharmaceutical, semiconductor, defense, nuclear and financial sector targets, compromising at least nine organizations and conducting password spraying and credential scanning against at least a dozen more.
GoKawiil's interpretation of the reporting above, not reported fact.
CrowdStrike describes this as an escalation from single AI-assisted intrusions to multiple simultaneous operations coordinated by one human operator, which could signal that AI agents are letting fewer people run broader campaigns. The reported involvement of ARTEX, a tool originally open-source before its creators restricted it after misuse, suggests attackers are adapting commercial and open AI tooling faster than vendors can lock it down.
- Vapor Panda allegedly used ARTEX AI plus DeepSeek and another LLM to run coordinated attacks across 200+ organizations in 14 countries since October 17.
- Targets spanned government, telecom, pharmaceutical, semiconductor, defense, nuclear and financial sectors, with at least nine confirmed compromises.
- CrowdStrike says the campaign shows AI agents scaling cyberespionage from single intrusions to multiple simultaneous human-directed operations.
YubiKey 5 Series Security Key — With state-sponsored actors automating credential theft and password spraying at massive scale, hardware-based authentication is one of the few defenses that actually stops account takeover even if passwords leak. A YubiKey adds a physical second factor that AI-driven attacks like those described can't replicate remotely, making it a smart upgrade for anyone managing sensitive accounts or organizational logins.</p>
See YubiKey 5 Series Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-11-02
Published there as: “Chinese hackers use ARTEX AI in automated attacks against 200 orgs”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.