CrowdStrike Discloses Chinese Hacker Group Vapor Panda Using AI Framework ARTEX in Cyber Espionage Targeting 200+ Organizations Globally

US cybersecurity firm CrowdStrike disclosed that a group it characterizes as a Chinese hacker organization, named Vapor Panda, has been conducting a large-scale global cyber espionage campaign since October 17, 2026, using the open-source AI penetration testing framework ARTEX. The operation targets over 200 enterprise organizations across at least 14 countries, including diplomatic departments in Latin America, Europe, Asia, and the Middle East, US semiconductor, defense, pharmaceutical, nuclear, and financial institutions, and telecom companies in the US, Belgium, and the Philippines. ARTEX was deployed alongside China's large language model DeepSeek and another commercial model.

In the attack workflow, ARTEX serves as the primary coordinator, assigning tasks to main agents, planning agents, and worker agents based on reconnaissance findings to advance multiple intrusion tasks simultaneously. CrowdStrike noted that the planning agent in a single intrusion consumed approximately 1.4 billion tokens, reflecting the scale of automation. Attackers did not rely entirely on autonomous execution; they manually input prompts in Simplified Chinese to instruct AI agents to establish backdoors, obtain domain administrator passwords, and specifically search for computers without CrowdStrike Falcon endpoint protection installed, concentrating attacks on less defended devices.

Nine victim organizations have had the BloodAlchemy backdoor implanted, suffering password spraying, network scanning, and environment reconnaissance. CrowdStrike emphasized that this activity differs from the campaign by Storm-0940, a China state-level threat actor previously disclosed by Microsoft, indicating rapid adoption of ARTEX within China's cybercrime ecosystem. The company predicts that Chinese hackers will continue to use such AI agent frameworks to compromise multiple targets over the next year.