A Chinese cyberespionage group has deployed the ARTEX AI framework to automate attacks against more than 200 organisations across 14 countries, security researchers revealed on Monday. The campaign, which began on 17 October 2026, targeted government ministries, telecommunications providers, and critical infrastructure sectors using autonomous software agents directed by human operators.
Key points
- A China-nexus threat group tracked as Vapor Panda has targeted over 200 organisations using the ARTEX AI multi-agent penetration-testing framework.
- The automated campaign compromised at least nine organisations across telecommunications, pharmaceutical, and government sectors in North America, Europe, Latin America, and the Middle East.
- Attackers combined ARTEX with DeepSeek models, generating over 1.4 billion input tokens in a single compromised network while instructing agents to avoid protected endpoints.
- The operation follows a September breach at Dutch security institute DIVD, where autonomous ARTEX agents reached root access within 12 minutes.
Scale and targets of the Vapor Panda campaign
Researchers at CrowdStrike’s threat intelligence team identified the actor as Vapor Panda, a China-nexus espionage group. The group focused its automated reconnaissance and exploitation efforts on high-value targets across 14 countries, hitting sectors including semiconductors, defence, nuclear energy, pharmaceuticals, and finance.
The threat actor succeeded in compromising at least nine victim organisations. Researchers also detected credential-scanning and password-spraying operations against at least 12 other high-priority entities. Among those compromised were telecoms carriers in Belgium and the US, American drug manufacturers, and public sector departments in Greece, Latin America, and the Middle East.
According to CrowdStrike, the “campaign marks an escalation in China-nexus use of AI agents, from single intrusions to multiple simultaneous engagements directed by a human operator.” The shift allowed a small team of human handlers to oversee widespread network compromises concurrently rather than working through one victim at a time.
In the intrusion targeting a Greek government body, the AI agents forged an administrator token and read internal mailboxes. To do this, the agents extracted and reused authentication keys found inside a mail-server directory export dating back to 2022. The group also installed BLOODALCHEMY, a backdoor active since 2023, on compromised government networks in Latin America and the Middle East.
How the multi-agent framework works
ARTEX AI originated as an open-source penetration-testing suite built by Chinese software developers. Its creators later pulled the public code and converted the tool into proprietary software after other threat groups used it in real-world attacks, including an earlier campaign against South Korean financial institutions.
Unlike simple scripting tools, the framework coordinates multiple autonomous agents assigned to discrete duties. Worker agents carry out port scanning, fingerprint web services, and hunt for vulnerabilities, while planning agents evaluate the output and select the next stage of the attack path. Similar multi-agent coordination architectures have emerged across the software industry, such as when Uber MCP Gateway unifies agent tools to coordinate internal software workflows.
During the October campaign, Vapor Panda paired ARTEX with large language models to guide tactical planning. The group used DeepSeek alongside a second, unidentified commercial model. These models processed environment feedback from victim networks and suggested commands for execution.
Human operators supplied high-level targets and instructions written in Chinese. The human handlers monitored progress and stepped in at critical junctures when an agent needed authorisation or hit a barrier. Otherwise, the agents operated on their own: they exploited software flaws, planted web shells, harvested credentials, and switched to alternative attack vectors when their initial attempts failed.
Token consumption and endpoint evasion
The operational scale required significant computing resources. In one network breach analysed by CrowdStrike, the automated system chewed through more than 1.4 billion input tokens. This vast volume of data reflects the iterative nature of autonomous agents, which constantly feed network logs, command outputs, and directory trees back into language models to determine their next steps.
The human operators also tuned their toolset to minimise detection on defended networks. Instructions sent to the agents explicitly ordered them to bypass Windows machines protected by CrowdStrike Falcon endpoint software. Instead, the agents sought out unmonitored systems and unpatched perimeter servers to establish initial footholds.
Targeting unmanaged systems remains a familiar tactic in supply chain and enterprise breaches, echoing vulnerabilities seen during the supermarket refrigeration cyberattack across Europe where ancillary systems served as an attack surface.
The DIVD intrusion and autonomous speed
The findings from CrowdStrike align with disclosures made by the Dutch Institute for Vulnerability Disclosure (DIVD), an independent security research organisation based in the Netherlands. In September 2026, DIVD suffered a network breach that it attributed directly to an autonomous ARTEX AI deployment.
DIVD reported that the software agent gained initial access and escalated privileges to root level in 12 minutes. The agent achieved this by chaining two distinct zero-day vulnerabilities: an initial flaw in the Zammad helpdesk platform, followed by a separate local privilege escalation exploit.
Once inside the network, the agent ran dozens of operations in parallel. It read compromised internal mailboxes, swept the internal network for reachable subnets, scraped authentication tokens from memory, and initiated automated password resets. DIVD recorded more than 450,000 HTTP requests and 2,500 distinct scripts generated during the breach, calling the activity “super loud and messy.”
The sheer volume of network noise generated by ARTEX contrasts with traditional human-led espionage, which generally prioritises stealth over speed. By trading operational silence for high-speed automated probing, the operators aimed to extract critical data and establish persistent backdoors before internal security operations teams could detect the anomalous traffic.
Security analysts expect multi-agent attack frameworks to proliferate further as threat actors adopt commercial and open-weight models to automate offensive operations. Network defenders face the challenge of identifying and blocking intrusions that operate at machine speed rather than the slower pace of manual human keystrokes.
