ARTEX AI targeted 200 organizations across 14 countries

A China-nexus crew that CrowdStrike tracks as Vapor Panda used ARTEX, a multi-agent penetration-testing framework, against more than 200 organizations in 14 countries. The operation started on October 17, 2026. The list is a priority sheet: government ministries, telecommunications providers, and organizations in pharmaceuticals, semiconductors, defense, nuclear work, and finance. At least nine organizations were compromised. At least twelve further high-value targets saw password spraying and credential scanning.

CrowdStrike names telecommunications providers in the United States and Belgium, government organizations in Greece, the Middle East, and Latin America, and pharmaceutical firms in the United States. That is an espionage set. It is a campaign with a human still in charge of several jobs at once.

CrowdStrike describes the shift in plain terms. Earlier use of AI agents by China-nexus operators looked like one intrusion at a time. Here, planner and worker agents ran many engagements together, and a person stepped in when a decision was required. Instructions were issued in Chinese. The agents did reconnaissance, went after vulnerabilities, placed web shells, collected credentials, and changed course when a path failed. In one intrusion they consumed more than 1.4 billion input tokens. That figure is an attacker budget. It is also a reminder that the landing host has to be visible to anyone who hopes to notice the work.

What the operators actually used

ARTEX began as an open-source project from developers in China. The makers later took it private after it was used in real intrusions, including against financial institutions in South Korea. Copies that had already circulated stayed in circulation. Alongside ARTEX, Vapor Panda used DeepSeek and a second commercial language model, which CrowdStrike has not named, to coordinate the parallel work.

In the intrusion at a Greek government organization, the agents drew on authentication keys from a 2022 export of a mail-server directory, produced an administrator token, and read mailboxes. A directory dump from four years ago still functioned as a live credential.

The same crew deployed BLOODALCHEMY, a backdoor active since 2023, against government entities in Latin America and the Middle East. They also told the agents to pass over Windows machines running CrowdStrike Falcon and to spend the effort on hosts without that agent. The uncovered machine was the one they wanted.

The Dutch Institute for Vulnerability Disclosure says the September 2026 break-in on its own network was ARTEX too. The institute’s account: an agent reached root about twelve minutes after the first foothold, using unpublished flaws that included one in the Zammad helpdesk, and the run was loud. DIVD recorded on the order of 450,000 requests and 2,500 scripts and described the activity as disorderly. Speed and noise arrived together.

This desk will not describe those flaws, the token steps, or the prompts the operators typed. The public impact is the victim set, the confirmed count, and the fact that a directed agent stack is already doing this work.

What to change this week

Ministries, carriers, chip firms, defense suppliers, nuclear-related organizations, and banks should assume they are a reasonable target. Patch the internet-facing software you actually run. If you run Zammad, restrict who can reach the helpdesk and take the vendor’s current fixes as soon as they exist. A support portal is a front door.

Find old directory exports, mailbox dumps, and authentication-key backups. The Greek case used a 2022 export. Rotate every secret those files still represent, then delete the files. A credential that survives in a share outlives the server it was copied from.

Put endpoint detection on every host that can reach mail or the internal network, including the boxes nobody calls production. The operators steered toward machines without a major agent installed. An uncovered server was the working set in this campaign.

Hunt for password spraying, new web shells on public applications, and bursts of internal scanning that do not match a scheduled test. DIVD’s intrusion was noisy. A queue that only pages on a quiet, single-host infection will miss a pile of requests. Any internal use of a multi-agent pentest framework belongs on a written authorization. An ARTEX-class install that the security team did not approve is an incident.

This briefing relies on public reporting by BleepingComputer and on research from CrowdStrike and the Dutch Institute for Vulnerability Disclosure. It does not include exploit procedures.