Vapor Panda
Threat actorSecurity timeline
- Activity reported by The Hacker NewsChinese state-linked group Vapor Panda uses AI-powered ARTEX framework against high-value targets
Recent news
ARTEX AI framework used by state-linked and criminal hackers to automate enterprise attacks
ARTEX is a multi-agent AI penetration-testing framework that can plan and run reconnaissance, exploitation and post-compromise steps, reviewing tool output and adjusting its next action. Google Threat Intelligence Group and Mandiant reported its use in Active Directory attacks, privilege escalation, cloud reconnaissance, lateral movement and exfiltration preparation, Microsoft linked it to Storm-0940, and CrowdStrike tied it to VAPOR PANDA, which targeted more than 200 organisations. The article stresses that the main risk is how quickly existing weaknesses, such as stolen passwords and excessive permissions, can be found and chained together.
China-linked groups use AI agents to probe enterprise defences in global campaigns
CrowdStrike reported that VAPOR PANDA used the AI pentesting framework ARTEX against more than 200 organisations over 11 days from October 17, with post-exploitation confirmed at nine. Attackers used AI agents to check whether Falcon sensors were installed, reused unrotated authentication keys, and combined an unsigned SAML assertion with an XXE flaw to gain administrative cloud access. Akshat Tyagi of HFS Research said CISOs should monitor their whole environment, rotate credentials and prepare for faster automated intrusions.
China-backed group used agentic AI tool ARTEX to compromise about 140 targets in 11 days
CrowdStrike tracks the China state-backed group Vapor Panda, which is using ARTEX, an automated agentic AI penetration testing framework, paired with DeepSeek. The campaign has targeted more than 200 organisations in at least 14 countries since 17 October, with about 70% of targets confirmed or likely compromised, and it remains active. CrowdStrike says organisations need visibility into endpoints, identities and cross-domain capabilities to respond.
Chinese state-linked group Vapor Panda uses AI-powered ARTEX framework against high-value targets
CrowdStrike attributes use of ARTEX, a Go-based AI-powered penetration testing framework, to a China-based targeted intrusion adversary it tracks as Vapor Panda, previously VexatiousTemper. The headline refers to more than 200 organisations worldwide, but the supplied text is truncated and gives no detail on victims, sectors or techniques. The activity is described as aimed at high-value targets simultaneously.