Chinese State-Backed Group Uses AI Framework ARTEX to Hit More Than 200 Organisations

CrowdStrike has attributed a new wave of attacks to a China-based group it tracks as Vapor Panda, previously known as VexatiousTemper and overlapping with Trend Micro's Earth Estries. The group used a Go-based, AI-powered penetration testing framework called ARTEX. According to CrowdStrike, tools like this let a small team pursue a wider set of targets than manual operations would support, rather than changing the group's core mission of building access.

Starting October 17, 2026, Vapor Panda reportedly used ARTEX against more than 200 organisations. Targets included foreign ministries in Latin America, Europe, Asia and the Middle East, US semiconductor, defence and think tank organisations, and telecommunications providers in several regions. Post-exploitation activity was confirmed at nine organisations, where the attacker deployed BLOODALCHEMY, a derivative of ShadowPad, then carried out credential spraying, network scanning and reconnaissance. Password spraying and credential scanning were also seen against at least 12 other organisations.

ARTEX works with DeepSeek and an unidentified subscription-based commercial large language model. It uses planner and worker agents that coordinate to move from initial access to host reconnaissance and lateral movement. A human operator stays in the loop, directing the agents to write web shells, extract domain administrator passwords and enumerate endpoint sensor coverage. In one intrusion, the planning agents consumed roughly 1.4 billion input tokens, which CrowdStrike says points to the scale of the automation.