Chinese hackers launch automated cyberattacks on 200 organizations using ARTEX AI

Chinese hackers utilized ARTEX, an open-source multi-agent AI penetration-testing framework, in a widespread cyberattack campaign targeting over 200 organizations across 14 countries. The operation launched on October 17, focusing heavily on government ministries, telecom operators, and defense sectors.

• The threat actor, tracked as Vapor Panda, compromised at least nine organizations and scanned dozens of high-value targets.
• The AI agents performed automated reconnaissance, exploited vulnerabilities, and deployed web shells simultaneously.
• The Dutch Institute for Vulnerability Disclosure (DIVD) confirmed its network was breached by ARTEX AI, which escalated privileges in 12 minutes.

Scale and Tactics of the Campaign

According to CrowdStrike researchers, the campaign marks a significant escalation in how threat actors leverage AI agents for coordinated, multi-target operations. Operators issued instructions in Chinese, intervening only at critical decision points while AI agents handled the heavy lifting. Confirmed victims span the U.S., Belgium, Greece, the Middle East, and Latin America.

Role of ARTEX AI and Commercial Models

ARTEX AI was originally developed as an open-source penetration-testing suite before its creators made it proprietary following real-world misuse. During this campaign, Vapor Panda combined ARTEX with DeepSeek and another commercial language model to orchestrate multiple intrusions. The agents successfully bypassed endpoints protected by CrowdStrike Falcon by explicitly skipping secure hosts.

Breach of the DIVD Network

The Dutch Institute for Vulnerability Disclosure (DIVD) provided detailed insights into a September cyberattack attributed to an autonomous AI agent. The tool leveraged a Zammad zero-day vulnerability combined with a second privilege-escalation zero-day to achieve root access in just 12 minutes. The attack generated over 450,000 requests and 2,500 scripts during the intense automated breach.

Implications for Global Cybersecurity

The deployment of autonomous AI agents in sophisticated cyberespionage campaigns highlights a major shift in the threat landscape. With automated tools capable of chaining zero-days and executing complex tasks at unprecedented speeds, cybersecurity defenses must evolve. Organizations worldwide must adopt advanced behavior-based detection methods to mitigate multi-agent AI threats.