Chinese state-sponsored hackers have been identified using an AI-driven tool named ARTEX to conduct cyber-attacks on numerous organizations worldwide. This sophisticated framework, written in Go, enables rapid and expansive penetration testing, focusing on high-value targets.
Vapor Panda: The Threat Actor Behind the Attacks
The group responsible, known as Vapor Panda, has been tracked by cybersecurity firm CrowdStrike since February 2021. Previously referred to as VexatiousTemper, this hacking entity aligns with other known threat clusters like Earth Estries identified by Trend Micro. Vapor Panda has been particularly active since October 17, 2026, when it targeted over 200 organizations globally.
Their targets include foreign ministries across Latin America, Europe, Asia, and the Middle East, and sectors like semiconductors, defense, and telecommunications in the U.S. CrowdStrike’s report highlights a Middle Eastern interior ministry and several European defense and justice entities as among the victims.
ARTEX: A Tool for Mass Cyber Intrusions
ARTEX is central to Vapor Panda’s operations, utilizing DeepSeek and a commercial large language model to execute widespread intrusions. The tool employs various agents to automate tasks from initial access to detailed reconnaissance and lateral movements within networks. A human operator directs these agents to execute complex actions like deploying web shells and extracting administrator credentials.
This strategy allows for multiple concurrent attacks, bypassing traditional endpoint defenses and employing advanced techniques such as chaining Security Assertion Markup Language (SAML) assertions and XML external entity (XXE) flaws to escalate privileges.
Expanding Threats and Emerging Panda Groups
The use of ARTEX reflects a broader trend among Chinese threat actors, with the tool’s creator, Li Puhua, opting to make it closed source due to its rapid adoption. This development coincides with the identification of new Chinese state-sponsored groups like Hollow Panda, Overcast Panda, Titan Panda, and Veiled Panda, each with unique methodologies and targets.
For instance, Overcast Panda has been linked to the deployment of the FlowCloud backdoor through close access intrusions, exploiting travel vulnerabilities of personnel, while Titan Panda focuses on legal billing software, leveraging vulnerabilities in Intapp Time Server for remote code execution.
The increasing sophistication and scale of these cyber campaigns underscore the need for enhanced global cybersecurity measures to protect against such advanced persistent threats.
