China-nexus Vapor Panda uses ARTEX AI agents in automated intrusions against 200+ organizations in 14 countries
CrowdStrike reports that the China-nexus actor Vapor Panda used ARTEX AI, a multi-agent AI penetration-testing framework, in a campaign that began on October 17 against more than 200 organizations in 14 countries. Targets included government ministries, telecommunications providers, and the pharmaceutical, semiconductor, defense, nuclear, and financial sectors. At least nine organizations were compromised, and password spraying and credential scanning were run against at least 12 other high-value targets. CrowdStrike calls this an escalation from single intrusions to multiple simultaneous engagements directed by one human operator. Separately, the Dutch Institute for Vulnerability Disclosure (DIVD) says the AI-driven attack on its network in September 2026 used ARTEX AI.
Entenda a falha
A vulnerabilidade
The Dutch Institute for Vulnerability Disclosure (DIVD) says the AI agent that breached its network in September 2026 chained two zero-days. The first is in Zammad, the ticketing and help-desk platform, and gave initial access. The second is an unnamed local privilege escalation that took the agent to root. Neither has a CVE in the articles, and they do not describe the flaw type, the affected or fixed versions, or what an attacker needs (authentication, configuration, network reach). They only say the chain went from initial access to root in 12 minutes.
Como funciona
The articles do not describe the internal mechanism of either flaw. What they report is the sequence of the intrusion: the agent used the Zammad zero-day to get in, then the local privilege escalation to reach root. After that it read a compromised mailbox, scanned the internal network, extracted login tokens and tried password resets, running many tasks at once. At which step the Zammad or the privilege escalation code fails is not stated.
Por que é vulnerável
The articles do not give the root cause of either zero-day, nor what a fix would change. No patch or vendor advisory is mentioned. What the coverage does show is that an automated agent could chain two previously unknown flaws quickly, though it says nothing about why the flaws went unnoticed.
Como foi descoberta
The flaws came to light through the attack on DIVD itself in September 2026, which DIVD first attributed to an AI agent. In a later update, shared in a LinkedIn post, DIVD said the tool was ARTEX AI, acting autonomously. It recorded more than 450,000 requests and 2,500 scripts tied to the attack and called the activity "super loud and messy". Separately, CrowdStrike reported the wider Vapor Panda campaign using ARTEX AI. The articles do not say how the attacker found the zero-days or whether Zammad's maintainers were notified.
Explicação gerada por IA a partir da matéria e dos artigos, em 02/11/2026 19:16.
Detalhes técnicos
- Confirmed victims: telecommunications providers in the US and Belgium; government organizations in Greece, the Middle East, and Latin America; pharmaceutical firms in the US.
- In the Greek government intrusion, the agents forged an administrator token and read mailboxes using authentication keys from a 2022 mail-server directory export.
- Vapor Panda used DeepSeek and a second, unidentified commercial LLM to coordinate planning and worker agents across several intrusions at once. Operators issued instructions in Chinese and intervened at key decision points.
- The agents performed reconnaissance, exploited vulnerabilities, deployed web shells, obtained credentials, and switched to alternative attack paths when needed.
- Operators told the agents to skip Windows hosts protected by CrowdStrike Falcon and to focus on unprotected hosts.
- In one intrusion the agents consumed more than 1.4 billion input tokens, according to the researchers.
- The BLOODALCHEMY backdoor, active since 2023, was deployed against government entities in Latin America and the Middle East.
- ARTEX AI was first released as open source and later made proprietary after real-world abuse, including a campaign against South Korean financial institutions.
- DIVD says its intrusion went from initial access to root in 12 minutes by chaining a Zammad zero-day with a second zero-day for local privilege escalation. The agent read a mailbox, scanned the internal network, extracted login tokens, and attempted password resets. DIVD recorded over 450,000 requests and 2,500 scripts, describing the activity as "super loud and messy."
Remediação
The article gives no explicit remediation guidance. It implies that endpoint protection coverage matters, since operators steered agents away from Falcon-protected Windows hosts and toward unprotected ones.
Linha do tempo
-
China-nexus Vapor Panda uses ARTEX AI agents in automated intrusions against 200+ organizations in 14 countries
ler a análise desta fonte ocultar
CrowdStrike reports that the China-nexus actor Vapor Panda used ARTEX AI, a multi-agent AI penetration-testing framework, in a campaign that began on October 17 against more than 200 organizations in 14 countries. Targets included government ministries, telecommunications providers, and the pharmaceutical, semiconductor, defense, nuclear, and financial sectors. At least nine organizations were compromised, and password spraying and credential scanning were run against at least 12 other high-value targets. CrowdStrike calls this an escalation from single intrusions to multiple simultaneous engagements directed by one human operator. Separately, the Dutch Institute for Vulnerability Disclosure (DIVD) says the AI-driven attack on its network in September 2026 used ARTEX AI.
Technical Details
- Confirmed victims: telecommunications providers in the US and Belgium; government organizations in Greece, the Middle East, and Latin America; pharmaceutical firms in the US.
- In the Greek government intrusion, the agents forged an administrator token and read mailboxes using authentication keys from a 2022 mail-server directory export.
- Vapor Panda used DeepSeek and a second, unidentified commercial LLM to coordinate planning and worker agents across several intrusions at once. Operators issued instructions in Chinese and intervened at key decision points.
- The agents performed reconnaissance, exploited vulnerabilities, deployed web shells, obtained credentials, and switched to alternative attack paths when needed.
- Operators told the agents to skip Windows hosts protected by CrowdStrike Falcon and to focus on unprotected hosts.
- In one intrusion the agents consumed more than 1.4 billion input tokens, according to the researchers.
- The BLOODALCHEMY backdoor, active since 2023, was deployed against government entities in Latin America and the Middle East.
- ARTEX AI was first released as open source and later made proprietary after real-world abuse, including a campaign against South Korean financial institutions.
- DIVD says its intrusion went from initial access to root in 12 minutes by chaining a Zammad zero-day with a second zero-day for local privilege escalation. The agent read a mailbox, scanned the internal network, extracted login tokens, and attempted password resets. DIVD recorded over 450,000 requests and 2,500 scripts, describing the activity as "super loud and messy."
Remediation
The article gives no explicit remediation guidance. It implies that endpoint protection coverage matters, since operators steered agents away from Falcon-protected Windows hosts and toward unprotected ones.