Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide
Summary: CrowdStrike attributes to China-based Vapor Panda the use of a Go-based AI-powered penetration testing framework called ARTEX against more than 200 organizations worldwide starting October 17, 2026, including foreign ministries in Latin America, Europe, Asia, and the Middle East, and semiconductor, defense, and think tank organizations in the U.S. Post-exploitation was confirmed at nine organizations, where the attacker deployed BLOODALCHEMY, a ShadowPad derivative, followed by credential spraying, network scanning, and reconnaissance, with password-spraying and credential-scanning also conducted against at least 12 additional organizations.
Why it matters: In a single intrusion, Vapor Panda's planning agents consumed roughly 1.4 billion input tokens, and a human operator only stepped in to steer agents writing web shells, extracting domain administrator passwords, and enumerating endpoint sensor coverage across web applications, cloud services, containers, Active Directory, and mail and VPN infrastructure.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026