At least nine organizations were compromised in a China-linked espionage campaign that used ARTEX AI to attack more than 200 organizations in 14 countries, BleepingComputer reported on November 2, citing CrowdStrike researchers. The attackers combined AI agents with human supervision to run intrusions concurrently, moving beyond the individual AI-assisted break-ins previously described by the researchers.
CrowdStrike tracks the group as Vapor Panda. Its operation began on October 17 and reached government ministries, telecommunications providers and organizations working in pharmaceuticals, semiconductors, defense, nuclear activities and finance. At least 12 additional high-value targets faced password spraying—trying passwords across many accounts—and searches for usable credentials.
The confirmed compromises spanned telecommunications providers in the United States and Belgium, U.S. pharmaceutical firms, and government organizations in Greece, the Middle East and Latin America.
Old authentication keys enabled mailbox access
One Greek government intrusion shows the practical consequences of the agents’ work. CrowdStrike said they took authentication keys from a 2022 mail-server directory export and used them to create a forged administrator token, a digital credential granting administrator access. That allowed them to read mailboxes.
Across the campaign, the agents investigated targets, exploited software flaws, collected credentials and installed web shells, scripts that give attackers remote access to compromised servers. When one route failed, they tried other paths.
Human operators remained involved. CrowdStrike said they instructed the agents in Chinese and took over at critical decision points. Alongside ARTEX, Vapor Panda used DeepSeek and another, unidentified commercial language model to coordinate agents responsible for planning and carrying out work across simultaneous intrusions.
Researchers believe a single intrusion consumed more than 1.4 billion input tokens, the units of text supplied to language models.
The operators also set explicit limits on where the agents should operate: they told them to bypass Windows machines running CrowdStrike’s Falcon endpoint-protection software and concentrate on hosts without that protection. Separately, CrowdStrike found BLOODALCHEMY deployed against government entities in Latin America and the Middle East. That backdoor, software providing covert access, has been active since 2023.
ARTEX also identified in DIVD attack
ARTEX was built by Chinese developers as a penetration-testing suite, software intended to assess security by attempting intrusions. It coordinates multiple AI agents. Although initially released as open source, its developers subsequently made it proprietary following its use in real attacks, including a campaign targeting South Korean financial institutions.
Another organization has now named ARTEX in its own incident account. The Dutch Institute for Vulnerability Disclosure, or DIVD, said the tool operated autonomously during an attack on its network in September 2026. BleepingComputer reported the institute’s latest details from a LinkedIn post.
DIVD said the attacker needed just 12 minutes to advance from initial access to root privileges, the highest level of system control. The agent combined a Zammad zero-day—a previously unknown vulnerability—with another zero-day that allowed it to increase its privileges locally.
Several activities ran at once: the agent inspected a compromised mailbox, explored the internal network, extracted login tokens and tried to reset passwords. DIVD’s latest account put the scale at more than 450,000 requests and 2,500 scripts connected to the attack, activity it characterized as “super loud and messy.”
