Vapor Panda uses ARTEX AI framework against 200 organizations
CrowdStrike has reported that the China-linked intrusion group it tracks as Vapor Panda, formerly VexatiousTemper, used the Go-based, AI-powered penetration-testing framework ARTEX against more than 200 organizations worldwide. The activity began on October 17, 2026 and targeted foreign ministries, US organisations in pharmaceutical, semiconductor, defence, nuclear and financial sectors, and telecommunications providers in several regions.
The campaign stands out for the use of ARTEX to run multiple intrusion efforts concurrently. CrowdStrike said the framework combines DeepSeek with an unidentified subscription-based commercial large language model, coordinating planner and worker agents as they move from initial access to host reconnaissance and lateral movement. Human operators remain involved, directing the agents to create web shells, extract domain administrator passwords and identify endpoint sensor coverage.
Automated agents expand the number of attack paths
CrowdStrike attributed the activity to a China-based targeted intrusion adversary first identified in February 2021. The group overlaps with the Earth Estries cluster described by Trend Micro. ARTEX does not replace Vapor Panda's established access-development mission; instead, CrowdStrike said agentic tooling lets a small team pursue a wider target set at greater speed than manual operations would support.
In one intrusion, the framework's planning agents consumed approximately 1.4 billion input tokens. That figure illustrates the scale of automated activity in a single case, while the overall campaign involved many separate targets. Recovered transcripts showed agents pursuing several paths in parallel and changing approach when an attempted route failed.
Confirmed post-exploitation at nine organisations
Post-exploitation activity was confirmed at nine organisations. Attackers deployed BLOODALCHEMY, a derivative of ShadowPad, then carried out credential spraying, network scanning and reconnaissance. CrowdStrike also observed password spraying and credential scanning against at least 12 additional organisations, including US think tanks and European government entities.
The documented techniques combined AI orchestration with familiar enterprise attack methods. In one case, agents chained an unsigned Security Assertion Markup Language assertion with an XML external entity flaw to query a cloud Instance Metadata Service. They then obtained a role capable of issuing administrative commands to thousands of instances and escalated access to recover an enterprise administrator account.
Other paths involved web shells, abuse of an unauthenticated orchestration service for root access in a production container environment, reading Local Administrator Password Solution passwords and resource-based constrained delegation to impersonate a privileged account. Agents also received authentication keys that had not been rotated since 2022, forged an administrator token to read mailboxes, and used VPN configurations and a client key recovered from email material to access an internal network.
Defensive priorities span identity and infrastructure
The reported activity crossed web applications, cloud services, containers, Active Directory, mail and VPN infrastructure. Zscaler ThreatLabz said ARTEX orchestrates multiple LLM backends for reconnaissance, vulnerability identification and exploitation, lowering the technical barrier for complex intrusion campaigns. Its developer, Li Puhua, also known as Autumn-27, has taken the tool closed source after its rapid adoption among threat actors.
For security teams, the campaign reinforces the operational importance of rotating long-lived authentication keys, reviewing privileged cloud roles, protecting container orchestration services, and monitoring identity, endpoint, mail and VPN activity together. A defence model that treats these systems separately may miss an intrusion in which automated agents move between them and pursue alternative routes.