China-backed group used agentic AI tool ARTEX to compromise about 140 targets in 11 days
- Severity
- High
- Sources
- 1
What happened
CrowdStrike attributes an active campaign to China state-backed Vapor Panda, which uses the ARTEX agentic AI pentesting framework with DeepSeek to run requests as often as every 10 seconds and pursue multiple attack paths concurrently. Roughly 140 targets were compromised in 11 days across more than 200 organisations in at least 14 countries since 17 October, including foreign ministries, defence and intelligence bodies, and US and telecom organisations. Observed agentic adversary activity rose from about 45 attacks in September to 126 in October; hands-on-keyboard activity reached over 1,500 commands an hour versus about 40 previously. No CVEs are named. Defenders should prioritise endpoint, identity and cross-domain visibility.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Ensure you have visibility into endpoints, identities and cross-domain activity so that agentic-speed intrusions can be detected.
- Treat the speed and scale of this campaign as a reason to act now rather than wait for further guidance.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Companies
Products