CrowdStrike says a China-linked group it tracks as VAPOR PANDA used ARTEX, an AI penetration-testing framework, to run intrusions against more than 200 organizations at once. Starting on October 17, the group went after foreign ministries in Latin America, Europe, Asia and the Middle East, plus semiconductor, defense and think-tank organizations in the U.S. and telecom providers in several regions. BleepingComputer, citing the report, says the campaign spanned 14 countries, compromised at least nine organizations, and included password spraying and credential scanning against at least 12 more.
What makes the campaign notable, according to CrowdStrike, is scale: earlier reports described AI agents helping with a single break-in, while here one human operator steered many engagements in parallel. ARTEX coordinated a main agent with planner and worker agents, driven mostly by the DeepSeek model plus a second commercial model CrowdStrike could not identify. Recovered transcripts show the operator giving instructions in Chinese and stepping in only at decision points. The agents did reconnaissance, wrote web shells, harvested credentials and tried alternative paths, and CrowdStrike estimates one intrusion consumed about 1.4 billion input tokens. In the Greek government case, BleepingComputer says the agents forged an administrator token and read mailboxes using keys from a 2022 mail-server directory export. The operators also told the agents to skip Windows machines running CrowdStrike Falcon, and CrowdStrike found the BLOODALCHEMY backdoor on government targets in Latin America and the Middle East.
CrowdStrike says this campaign is separate from the ARTEX activity Microsoft reported under the Storm-0940 name, which we covered in Microsoft Ties ConnectWise Attack to AI Agents and Storm-0940; see also the Seoul arrest of an alleged AI-assisted hacking gang leader. BleepingComputer adds that the Dutch Institute for Vulnerability Disclosure says ARTEX was the tool behind its September breach, which went from initial access to root in 12 minutes by chaining two zero-days.
How to check if you’re affected
Affected products and environments are those matching the initial-access and credential paths CrowdStrike describes: internet-facing applications exposed to SAML and XXE flaws, and long-lived Linux appliances. CrowdStrike’s recommendations are to rotate signing keys, preauthentication keys and service credentials after any suspected data exposure, including keys in historical backups and directory exports; enforce SAML signature validation; require IMDSv2 and limit cloud roles’ command-execution permissions; and patch internet-facing appliances, especially long-lived Linux servers.
For hunting, CrowdStrike lists these ARTEX markers: command-line parameters containing artx or artex, cloud roles prefixed artx, art18- comments in administration commands, and the directory C:\ProgramData\artx5v\. Its published BLOODALCHEMY indicators are the C2 domains nginxmysql[.]com, sqlserver-sqlite[.]com and www[.]ddduuuppp[.]com, with the loader DLL graphics-hook-filter64.dll and payload graphics-hook_config.bin. The report recommends running an EDR agent on all servers, including those not reachable from the internet.