conv.

All stories
SecurityQuiet 10d · day 13

Chinese hackers deploy AI tool ARTEX against 200+ organizations worldwide

CrowdStrike reports Vapor Panda using autonomous AI agents to target foreign ministries, defense contractors, and telecom providers across continents.

newest coverage 9d agosummary written 11d ago4 pieces NewswiresMastodonGoogle News

What to know

  • Vapor Panda deployed the AI-powered ARTEX framework against 200+ organizations starting October 17, targeting foreign ministries, defense contractors, semiconductors, think tanks, and telecoms globally.
  • ARTEX uses autonomous agents with DeepSeek and commercial LLMs to conduct reconnaissance, vulnerability discovery, and lateral movement with a human operator providing strategic direction—enabling one operator to manage multiple simultaneous intrusions.
  • Post-exploitation activity confirmed at 9 organizations; a single intrusion consumed 1.4 billion AI tokens, indicating massive scale of automated attack operations.
  • ARTEX's rapid adoption by threat actors prompted developer Li Puhua to make the framework closed source.

“Across these engagements, the agents pursued multiple attack paths in parallel, spanning web applications, cloud services, container environments, Active Directory, and mail and VPN infrastructure. They shifted to alternative approaches when a path failed.”

CrowdStrike, Cybersecurity analyst · The Hacker News ↗

Vapor Panda Chinese state-sponsored hacking groupCrowdStrike Cybersecurity firm and threat analystLi Puhua (Autumn-27) ARTEX framework developer

Chinese hackers deploy AI tool ARTEX against 200+ organizations worldwide
thehackernews.com

How it unfolded 1 development · click the chart to see its coverage articlesposts

Peak 1 piece in 3h at Oct 29, 11 PM; 4 pieces over 13 days (2 articles · 2 posts) Oct 29, 11 PM — 1 piece · 1 article — Newswires 1Oct 30, 2 AM — quietOct 30, 5 AM — quietOct 30, 8 AM — quietOct 30, 11 AM — quietOct 30, 2 PM — quietOct 30, 5 PM — quietOct 30, 8 PM — quietOct 30, 11 PM — quietOct 31, 2 AM — quietOct 31, 5 AM — quietOct 31, 8 AM — 1 piece · 1 post — Mastodon 1Oct 31, 11 AM — quietOct 31, 2 PM — 1 piece · 1 post — Mastodon 1Oct 31, 5 PM — quietOct 31, 8 PM — quietOct 31, 11 PM — quietNov 1, 1 AM — quietNov 1, 4 AM — quietNov 1, 7 AM — quietNov 1, 10 AM — quietNov 1, 1 PM — quietNov 1, 4 PM — quietNov 1, 7 PM — quietNov 1, 10 PM — quietNov 2, 1 AM — 1 piece · 1 article — Google News 1Nov 2, 4 AM — quietNov 2, 7 AM — quietNov 2, 10 AM — quietNov 2, 1 PM — quietNov 2, 4 PM — quietNov 2, 7 PM — quietNov 2, 10 PM — quietNov 3, 1 AM — quietNov 3, 4 AM — quietNov 3, 7 AM — quietNov 3, 10 AM — quietNov 3, 1 PM — quietNov 3, 4 PM — quietNov 3, 7 PM — quietNov 3, 10 PM — quietNov 4, 1 AM — quietNov 4, 4 AM — quietNov 4, 7 AM — quietNov 4, 10 AM — quietNov 4, 1 PM — quietNov 4, 4 PM — quietNov 4, 7 PM — quietNov 4, 10 PM — quietNov 5, 1 AM — quietNov 5, 4 AM — quietNov 5, 7 AM — quietNov 5, 10 AM — quietNov 5, 1 PM — quietNov 5, 4 PM — quietNov 5, 7 PM — quietNov 5, 10 PM — quietNov 6, 1 AM — quietNov 6, 4 AM — quietNov 6, 7 AM — quietNov 6, 10 AM — quietNov 6, 1 PM — quietNov 6, 4 PM — quietNov 6, 7 PM — quietNov 6, 10 PM — quietNov 7, 1 AM — quietNov 7, 4 AM — quietNov 7, 7 AM — quietNov 7, 10 AM — quietNov 7, 1 PM — quietNov 7, 4 PM — quietNov 7, 7 PM — quietNov 7, 10 PM — quietNov 8, 1 AM — quietNov 8, 4 AM — quietNov 8, 7 AM — quietNov 8, 10 AM — quietNov 8, 1 PM — quietNov 8, 4 PM — quietNov 8, 7 PM — quietNov 8, 10 PM — quietNov 9, 1 AM — quietNov 9, 4 AM — quietNov 9, 7 AM — quietNov 9, 10 AM — quietNov 9, 1 PM — quietNov 9, 4 PM — quietNov 9, 7 PM — quietNov 9, 10 PM — quietYesterday, 1 AM — quietYesterday, 4 AM — quietYesterday, 7 AM — quietYesterday, 10 AM — quietYesterday, 1 PM — quietYesterday, 4 PM — quietYesterday, 7 PM — quietYesterday, 10 PM — quietToday, 1 AM — quietToday, 4 AM — quietToday, 7 AM — quietToday, 10 AM — quietToday, 1 PM — quietToday, 4 PM — quietToday, 7 PM — quiet 1
Oct 30Oct 31Nov 1Nov 2Nov 3Nov 4Nov 5Nov 6Nov 7Nov 8Nov 9yesterdaynow · 9:14 PM ET
  1. 1

    Analysis reveals token consumption and operational architecture

    CrowdStrike reports ARTEX consumed 1.4 billion input tokens in a single intrusion, demonstrating massive scale of automated activity. Agents pursued multiple attack paths in parallel across web apps, cloud services, Active Directory, and VPN infrastructure, with ability to shift tactics when paths failed.

    “In a single intrusion, Vapor Panda's planning agents consumed on the order of 1.4 billion input tokens, indicating the scale of the automated activity…”
    — CrowdStrike
  2. background

    CrowdStrike discloses campaign mechanics and scope — CrowdStrike publishes detailed analysis revealing ARTEX uses autonomous planner and worker agents coordinated by a human operator to conduct reconnaissance, vulnerability discovery, and lateral movement. Post-exploitation confirmed at 9 organizations; credential spraying attempted against 12 more.

  3. background

    Vapor Panda launches AI-powered campaign against 200+ targets — Chinese state-sponsored threat group Vapor Panda begins large-scale coordinated attacks using ARTEX framework against foreign ministries, U.S. defense and semiconductor organizations, think tanks, and telecommunications providers across multiple continents.