My buddies at CrowdStrike have uncovered a campaign launched by threat actor VAPOR PANDA starting on October 17, 2026, where ARTEX (an AI-powered penetration testing tool developed in China) is used with the Chinese-developed DeepSeek LLM to attack “more than 200 distinct organizations worldwide, including foreign ministries in Latin America, Europe, Asia, and the Middle East; semiconductor, defense, and think tank organizations in the U.S.; and telecommunications providers in multiple regions.”
According to the CrowdStrike researchers, they observed an ARTEX controller linked to VENDOR PANDA infrastructure direct exploitation activity “against entities in at least 14 countries over an 11-day window.” This included “19 U.S.-based organizations in the pharmaceutical, semiconductor, defense, nuclear, and financial sectors.” CrowdStrike confirmed that VENDOR PANDA was able to gain access, deploy malware, conduct credential spraying, network scanning, and reconnaissance.
What was different about this campaign was the speed and scope of the operation. In this campaign, the AI agents used the pen testing tools to run multiple engagements that allowed the agents to pursue “multiple attack paths in parallel, spanning web applications, cloud services, container environments, Active Directory, and mail and VPN infrastructure. They shifted to alternative approaches when a path failed. This breadth likely enables a single operator to apply a wider range of techniques against more targets at once than would be feasible through manual operations.”
The use of ARTEX allowed the threat actors to attack more targets at a faster speed than seen before. CrowdStrike posits that the use of ARTEX, paired with commercially available LLMs will allow “small teams to quickly scale intrusions across many targets simultaneously.”
CrowdStrike recommends:
Rotate signing keys, preauthentication keys, and service credentials after any suspected data exposure, including keys contained in historical backups and directory exports.
Enforce SAML signature validation, require IMDSv2, and restrict cloud roles’ command-execution permissions to the minimum required instances.
Hunt for ARTEX markers, including command-line parameters containing artx or artex strings, artx-prefixed cloud roles, art18- administration-command comments, and the C:\ProgramData\artx5v\ directory.
Patch internet-facing appliances, particularly long-lived Linux-based servers, and ensure they run the latest available software and firmware.
Deploy an advanced, real-time endpoint detection and response (EDR) agent, such as the CrowdStrike Falcon sensor, across the environment, including on servers considered inaccessible from the public internet.
CrowdStrike published the indicators of compromise, which should be reviewed and blocked by IT professionals.
Click Here For The Original Source.
——————————————————–
