Chinese Vapor Panda Hackers Use AI-Powered ARTEX Framework to Target 200+ Organizations Worldwide
CrowdStrike and Zscaler ThreatLabz revealed that Chinese state-sponsored threat actor Vapor Panda has been deploying ARTEX, a Go-based AI-powered penetration testing framework, to simultaneously targe
Affiliate disclosure: We may earn a commission from qualifying purchases through these links at no additional cost to you. As an Amazon Associate I earn from qualifying purchases.
Chinese state-linked hacking group Vapor Panda has been using an AI-powered framework called ARTEX to target more than 200 organizations worldwide, according to reporting based on CrowdStrike and Zscaler ThreatLabz findings (The Hacker News, 2026-10-30).
The reported activity stands out not just for its scale, but for how much of the intrusion workflow ARTEX appears to automate. The framework is described as a Go-based penetration testing tool that can coordinate multiple large language model backends, including DeepSeek and an undisclosed commercial model, to carry out reconnaissance, identify vulnerabilities, and attempt exploitation with limited human involvement (The Hacker News, 2026-10-30).
What the reports say about ARTEX
According to the supplied findings, Vapor Panda — also referred to as VexatiousTemper and overlapping with the Earth Estries cluster — began using ARTEX on October 17, 2026, and has since targeted more than 200 distinct organizations worldwide (The Hacker News, 2026-10-30).
The framework is said to rely on planner and worker agents that coordinate tasks from initial access through lateral movement. In one intrusion, the planning agents reportedly consumed about 1.4 billion input tokens, underscoring the amount of automated decision-making involved in the campaign (The Hacker News, 2026-10-30).
Who was targeted
The findings describe a broad target set. Reported victims include foreign ministries in Latin America, Europe, Asia, and the Middle East, as well as U.S. organizations in the pharmaceutical, semiconductor, defense, nuclear, and financial sectors. Telecommunications providers in the U.S., Belgium, and the Philippines were also named among the targets (The Hacker News, 2026-10-30).
Because the source material is based on threat intelligence reporting, these target descriptions should be treated as attribution and assessment findings from the named researchers rather than independently verified public disclosures of each incident.
Why this matters
Zscaler ThreatLabz said ARTEX significantly lowers the technical barrier for conducting complex intrusion campaigns (The Hacker News, 2026-10-30). That claim, if accurate, matters because it suggests AI systems are being used not only for analysis or assistance, but as part of an operational intrusion pipeline.
The reporting also indicates post-exploitation behavior associated with the campaign, including deployment of BLOODALCHEMY, described as a ShadowPad derivative, and credential spraying (The Hacker News, 2026-10-30). These details suggest the activity goes beyond experimentation and into sustained intrusion tradecraft.
What remains uncertain
The supplied sources attribute the campaign to a Chinese state-sponsored actor, but that kind of attribution is inherently probabilistic and typically based on behavioral, infrastructure, and historical intelligence patterns rather than public confirmation from the actor itself. The findings provided here do not include the underlying evidence chain, so the attribution should be understood as the conclusion of the reporting organizations, not as courtroom-level proof.
Likewise, while the reports say ARTEX orchestrates multiple LLMs to automate reconnaissance and exploitation, the exact degree of autonomy, operator oversight, and success rate is not fully established in the source material.
Bottom line
If the reporting holds, ARTEX represents a notable step in the use of agentic AI for offensive cyber operations: an AI-driven framework used by a state-linked group to run parts of a large-scale intrusion campaign across more than 200 organizations (The Hacker News, 2026-10-30). The key takeaway is not just that attackers are using AI, but that they may be using it to scale and coordinate activities that were previously much harder to sustain manually.
Sources and dates
Research completed: 2026-10-31T05:07:00Z
Affiliate link: we may earn a commission at no additional cost to you. Check current features and terms before signing up.
Building your own website?
This separate resource is for readers creating an online business: Explore Systeme.io. It is an affiliate link, not an Amazon product recommendation.
This article may contain affiliate links. If you purchase through them, we may earn a commission at no additional cost to you.