Chinese hackers used ARTEX, an open-source multi-agent AI penetration-testing framework, in attacks against more than 200 organizations across 14 countries, compromising at least nine, according to researchers at cybersecurity firm CrowdStrike.
The operation began on October 17 and targeted government ministries, telecommunications providers, and organizations in the pharmaceutical, semiconductor, defense, nuclear, and financial sectors, CrowdStrike said. Confirmed victims include telecommunications providers in the United States and Belgium, government organizations in Greece, the Middle East, and Latin America, and pharmaceutical firms in the United States.
ARTEX AI is a multi-agent penetration-testing suite developed by Chinese developers and initially released as an open-source project. Its creators later made it proprietary after it was used in real-world attacks, including a campaign against South Korean financial institutions.
CrowdStrike said the "campaign marks an escalation in China-nexus use of AI agents, from single intrusions to multiple simultaneous engagements directed by a human operator." The attackers issued instructions in Chinese and intervened at critical points, while the AI agents performed reconnaissance, exploited vulnerabilities, deployed web shells, obtained credentials, and pursued alternative attack paths when needed. The operators explicitly instructed the agents to skip Windows machines protected by CrowdStrike's Falcon endpoint solution and to focus on unprotected hosts.
In the attack on a Greek government entity, the AI agents forged an administrator token and read mailboxes by leveraging authentication keys from a 2022 mail-server directory export, the researchers said. In one intrusion, the researchers believe the agents consumed more than 1.4 billion input tokens. Vapor Panda also used DeepSeek and a second, unidentified commercial language model to coordinate planning and worker agents across multiple intrusions, and deployed a backdoor known as BLOODALCHEMY, active since 2023, against government entities in Latin America and the Middle East.
Separately, the Dutch Institute for Vulnerability Disclosure (DIVD) said the tool used in the cyberattack on its own network in September was ARTEX AI, acting autonomously. In a LinkedIn post, DIVD said the attack went from initial access to root privileges in 12 minutes, chaining a Zammad zero-day with a second zero-day for local privilege escalation. The agent read a compromised mailbox, scanned the internal network, extracted login tokens, and attempted password resets. DIVD recorded over 450,000 requests and 2,500 scripts connected to the attack, describing the activity as "super loud and messy."
Analysis
Why This Matters
- The campaign shows state-nexus hackers using AI agents for multiple simultaneous intrusions, compressing the time between initial access and system compromise, with DIVD reporting root privileges in 12 minutes.
- Hundreds of organizations across critical sectors were targeted, indicating AI-enabled attacks are no longer experimental but operational.
- The use of a tool that moved from open source to proprietary after real-world misuse highlights the dual-use problem of AI penetration-testing software.
Background
ARTEX AI is an open-source, multi-agent AI penetration-testing framework developed by Chinese developers, later made proprietary after being used in real-world attacks. In this operation, CrowdStrike says human operators directed the agents, which performed tasks such as reconnaissance, credential theft, web shell deployment, and exploitation. The threat actor, tracked as Vapor Panda, also used other language models to coordinate planning and worker agents. The DIVD breach in September is a separate but related example of the same tool acting autonomously.
Key Perspectives
CrowdStrike researchers: say the "campaign marks an escalation in China-nexus use of AI agents, from single intrusions to multiple simultaneous engagements directed by a human operator."
DIVD: says ARTEX AI acted autonomously in its September attack, reaching root privileges in 12 minutes and producing activity it described as "super loud and messy."
What to Watch
- Whether additional victims are identified among the more than a dozen high-value targets that faced password spraying and credential scanning.
- Whether CrowdStrike or other vendors release detection and mitigation guidance for ARTEX AI campaigns.
- Whether ARTEX AI's developers further restrict or change the tool's availability following these attacks.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedChinese hackers used ARTEX in attacks against more than 200 organizations.BleepingComputer: “Chinese hackers used ARTEX, an open-source, multi-agent AI penetration-testing framework, in attacks against more than 200 organizations across 14 countries.”
- SupportedCrowdStrike said the campaign marked an escalation from single intrusions to simultaneous engagements directed by a human operator.BleepingComputer: “the "campaign marks an escalation in China-nexus use of AI agents, from single intrusions to multiple simultaneous engagements directed by a human operator."”
- SupportedDIVD described the activity as “super loud and messy.”BleepingComputer: “describing the activity as “super loud and messy.””
- SupportedCrowdStrike tracks the threat actor as Vapor Panda.BleepingComputer: “The researchers track the threat actor as Vapor Panda”
- SupportedDIVD said the tool used in its September network attack was ARTEX AI, acting autonomously.BleepingComputer: “the tool used in the attack on its network was ARTEX AI, which acted autonomously.”
- SupportedThe operation began on October 17.BleepingComputer: “The operation began on October 17”
- SupportedThe attacks spanned 14 countries.BleepingComputer: “in attacks against more than 200 organizations across 14 countries.”
- SupportedAt least nine organizations were compromised.BleepingComputer: “The threat actor compromised at least nine organizations”
- SupportedIn the Greek government entity attack, agents forged an administrator token and read mailboxes using authentication keys from a 2022 mail-server directory export.BleepingComputer: “the AI agents forged an administrator token and read mailboxes by leveraging authentication keys from a 2022 mail-server directory export.”
- SupportedResearchers believe the agents consumed more than 1.4 billion input tokens in one intrusion.BleepingComputer: “In one intrusion, the AI agents consumed more than 1.4 billion input tokens, the researchers believe.”
- SupportedDIVD said the attack went from initial access to root privileges in 12 minutes.BleepingComputer: “the attack went from initial access to root privileges in 12 minutes”
- SupportedDIVD recorded over 450,000 requests connected to the attack.BleepingComputer: “DIVD recorded over 450,000 requests and 2,500 scripts connected to the attack”
