China-linked espionage group Vapor Panda used ARTEX, a multi-agent AI penetration-testing framework, to target more than 200 organizations in at least 14 countries during an 11-day campaign that began October 17, according to CrowdStrike’s October 29 report.
The targets included foreign ministries in Latin America, Europe, Asia and the Middle East, as well as 19 U.S. organizations in the pharmaceutical, semiconductor, defense, nuclear and financial sectors. CrowdStrike also identified telecommunications providers in the United States, Belgium and the Philippines among the targets.
CrowdStrike confirmed post-exploitation activity at nine organizations, where the attackers deployed the BLOODALCHEMY backdoor and conducted credential spraying, network scanning and reconnaissance. The company also observed password-spraying and credential-scanning activity against at least 12 additional organizations.
The report says ARTEX coordinated multiple agents using DeepSeek and a second, unidentified commercial language model. A human operator issued instructions in Chinese and intervened at key decision points. In one intrusion, the planning agents consumed about 1.4 billion input tokens. Operators also directed the agents to identify Windows machines without CrowdStrike Falcon protection.
The campaign is separate from earlier ARTEX-assisted activity targeting South Korean financial institutions, including an incident involving a suspected China-based operator, and other AI-powered attacks against banks.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
