Chinese state-sponsored threat actors have been observed using a Go-based artificial intelligence (AI)-powered penetration testing framework called ARTEX in attacks aimed at high-value targets simultaneously.
The activity has been attributed by CrowdStrike to a China-based “targeted intrusion adversary” it tracks under the moniker Vapor Panda (previously VexatiousTemper). First identified in February 2021, the hacking group overlaps with a threat cluster detailed by Trend Micro as Earth Estries.
“Agentic tooling like ARTEX enables this scale of expansion at speed, allowing a small team to pursue a wider target set than manual operations would support, rather than a wholesale shift away from the adversary’s established access-development mission,” CrowdStrike said in a Thursday analysis.
Starting October 17, 2026, Vapor Panda is said to have used the AI tool against more than 200 distinct organizations across the world, including foreign ministries in Latin America, Europe, Asia, and the Middle East; semiconductor, defense, and think tank organizations in the U.S.; and telecommunications providers in multiple regions.
Some of the notable targets listed by CrowdStrike are listed below –
- Foreign ministries of two Latin America-based countries, Central America, and Asia
- A Middle East-based interior ministry
- A European country’s foreign ministry, presidency, and prime minister’s office, along with defense, justice, finance, and intelligence entities
- 19 U.S.-based organizations in the pharmaceutical, semiconductor, defense, nuclear, and financial sectors
- Telecommunications providers in the U.S., Belgium, and the Philippines
Post-exploitation activity has been confirmed at nine organizations, allowing the attacker to deploy BLOODALCHEMY, a derivative of ShadowPad, followed by credential spraying, network scanning, and reconnaissance.
Vapor Panda is also said to have conducted password-spraying and credential-scanning activity against at least 12 additional organizations, including U.S.-based think tanks and government entities in Europe.
Central to the operation is the use of ARTEX with DeepSeek and an as-yet-unknown, subscription-based commercial large language model (LLM) to conduct the intrusions at scale, leveraging an army of planner and worker agents that coordinate with each other in pursuit of a common goal to move from initial access to host reconnaissance and lateral movement.
A human operator in the loop oversees the operation, directing the agents to write web shells, extract domain administrator passwords, and enumerate endpoint sensor coverage.
“In a single intrusion, Vapor Panda’s planning agents consumed on the order of 1.4 billion input tokens, indicating the scale of the automated activity and implying far higher consumption across the operation as a whole,” CrowdStrike said.
Unlike some campaigns that used to assist with individual digital break-ins, the use of ARTEX is at a much higher level to run multiple engagements concurrently, with the human operator only stepping in to steer the agents to accomplish their objective, while taking steps to bypass endpoint defenses.
Analysis of the recovered transcripts highlights the use of ARTEX in combination with tried-and-tested approaches –
- Chaining an unsigned Security Assertion Markup Language (SAML) assertion and an XML external entity (XXE) flaw to query the cloud Instance Metadata Service. This is followed by obtaining a role that can issue administration commands to thousands of instances before escalating access to recover an enterprise administrator account.
- Deploying web shells, abusing an unauthenticated orchestration service to obtain root access in a production container environment, reading Local Administrator Password Solution (LAPS) passwords, and leveraging resource-based constrained delegation to impersonate a privileged account.
- Supplying the agent with a set of authentication keys that had not been rotated since 2022, which then uses those keys to forge an administrator token and read mailboxes. In the next phase, the agent uses VPN configurations recovered from a user’s sent mail, along with a VPN client key originating from a purported May 2024 email leak, to reach the internal network.
“Across these engagements, the agents pursued multiple attack paths in parallel, spanning web applications, cloud services, container environments, Active Directory, and mail and VPN infrastructure,” CrowdStrike explained. “They shifted to alternative approaches when a path failed. This breadth likely enables a single operator to apply a wider range of techniques against more targets at once than would be feasible through manual operations.”
The development comes as ARTEX has witnessed broad adoption among threat actors in a short span of time, prompting its developer Li Puhua (“Autumn-27”) to take it closed source.
“It orchestrates multiple LLM backends to autonomously perform reconnaissance, vulnerability identification, and exploitation, significantly lowering the technical barrier for conducting complex intrusion campaigns,” Zscaler ThreatLabz said in a report published earlier this month.
One of Many Panda Threat Clusters
The disclosure also coincides with the emergence of four previously undocumented China-linked state-sponsored threat groups known as Hollow Panda, Overcast Panda, Titan Panda, and Veiled Panda, which have targeted a broad range of sectors across the world for intelligence gathering and intellectual property theft.
Overcast Panda, described as “one of the most operationally sophisticated and persistent threats facing organizations with personnel traveling to China,” has been linked to close access intrusions in which the adversary has deployed their proprietary FlowCloud backdoor on victims’ devices via direct physical access when those targets were in the country.
FlowCloud is launched by means of DLL sideloading, with its components designed to fly under the radar and resist forensic analysis. Command-and-control (C2) is accomplished through legitimate cloud infrastructure in an attempt to further conceal their presence.
“FlowCloud itself is a sophisticated, purpose-built tool uniquely associated with Overcast Panda,” CrowdStrike said. “Once deployed, FlowCloud provides the adversary with persistent, covert remote access to the target device, enabling keylogging, screen capture, file collection, and credential harvesting.”
Titan Panda, on the other hand, has been observed targeting legal billing software by exploiting a hard-coded Internet Information Services (IIS) machine key vulnerability in Intapp Time Server to achieve remote code execution across law firms.
The attacks, first detected in April 2026, led to the deployment of an in-memory framework called IceGiant to carry out reconnaissance, persistence, lateral movement, and data exfiltration. The threat actor is assessed to be operational since at least 2021, compromising several legal organizations in North America for over two years.
“How Titan Panda obtained the default machine keys is unknown, though IIS compromise of a legal entity running Intapp Time Server may have exposed the hardcoded keys in the application’s configuration file, enabling ViewState deserialization attacks against any organization running default installations,” CrowdStrike said.
