AI-Driven Hacking Tool Lets State-Backed Group Breach Around 140 Targets in 11 Days

A China state-backed threat group is using ARTEX, an automated, agentic AI penetration testing framework, to run a fast and wide-reaching hacking campaign, according to CrowdStrike. The group, tracked as Vapor Panda, has targeted more than 200 organisations in at least 14 countries since 17 October. About 140 sensitive targets were compromised in just 11 days. CrowdStrike told CyberScoop that roughly 70% of targets were confirmed compromised or showed evidence, at moderate confidence, of a successful intrusion.

Victims and targets include foreign ministries, a European country's presidency and prime minister's office, and defence and intelligence agencies. They also include 19 US-based organisations in the pharmaceutical, semiconductor, defence, nuclear and financial sectors, as well as telecom providers in the United States, Belgium and the Philippines. The campaign remains active.

What sets it apart is speed. Paired with DeepSeek, ARTEX let the group send requests as often as every 10 seconds and pursue several attack paths at once. CrowdStrike's Adam Meyers said hands-on-keyboard activity has typically involved up to 40 commands an hour, but with ARTEX it could exceed 1,500. He called this the first time CrowdStrike has seen an agentic nation-state adversary at this scale, and expects to see more of it. Spreading that effort across 200 targets costs the attackers very little, he said.