A China-nexus threat actor used an AI-based tool called Artex to run a sophisticated espionage campaign against multiple targets around the globe, according to a report released Thursday by CrowdStrike.
The threat actor, tracked as Vapor Panda, targeted more than 200 organizations in a total of 14 countries, in a campaign that began Oct. 17.
The actor targeted foreign ministries in Latin America, Asia and Europe, as well as an interior ministry in the Middle East. The campaign also targeted 19 different organizations in the U.S., including in the pharmaceutical, defense, semiconductor, nuclear and financial sectors. Telecom firms in the U.S., Philippines and Belgium were compromised.
At about nine organizations, the hackers deployed a backdoor called BloodAlchemy. After gaining access, the hackers conducted network scanning, reconnaissance and password spraying to reach internal systems. The group used password spraying and credential harvesting against 12 entities, including against U.S. think tanks and government entities in Europe.
Researchers said the attackers exploited critical flaws and misconfigurations found within these systems.
“At one U.S. organization, an agent exploited weaknesses in SAML authentication and XML processing to obtain cloud credentials with extensive administrative privileges,” Adam Meyers, senior vice president of counter adversary operations at CrowdStrike, told Cybersecurity Dive. At another organization, an agent gained root access through an orchestration service that lacked authentication.
The threat actor ran Artex alongside DeepSeek, the China-developed large language model. A second LLM was employed as well, but CrowdStrike researchers were unable to identify the specific model.
Researchers also observed agents “exploiting authentication keys exposed in a 2022 mail-server export, demonstrating how credentials compromised years earlier can continue to provide adversaries with access.”
Vapor Panda, recently tacked as Storm-0940, has been in operation since 2021, targeting government agencies, think tanks and energy sites in Europe, North America, Oceania and the U.K., according to CrowdStrike.
Agentic wave
Artex has been employed in a series of high profile-hacking campaigns in recent months. A China-nexus actor is linked to the abuse of ConnectWise Cloud Backup. The actor used Artex to scale attacks targeting Microsoft 365 tenants.
Wiz researchers discovered Artex used in attacks targeting identity providers, including Okta, Cognito and Microsoft Entra. The Wiz observations overlap with recent Microsoft research that linked the ConnectWise campaign to the China-linked actor, who is also tracked as Storm-0940.
Artex was also used in attacks targeting South Korean banks in a campaign that began in late September, according to CrowdStrike. Artex was also used in attacks targeting dozens of Japanese companies last month.
Artex is an open-source pen testing framework that can be used with different AI models to automate offensive security, according to Microsoft. The tool is written in the Go language, with a front end based on Next.js.
The Dutch Institute for Vulnerability Disclosure on Friday confirmed that Artex was used in a September hack targeting the organization. The attacker chained vulnerabilities in Zammad, an open-source help-desk platform, tracked as CVE-2026-102489 and CVE-2026-102490.
Multiple threat actors used open-source pentesting frameworks in recent months to automate attacks, according to a report released Friday by Google Threat Intelligence Group and its incident response unit Mandiant.
During numerous incident response investigations, hackers have been found using pen-testing platforms like Artex, Cairn and PentAGI to automate various tasks, including lateral movement, and exploiting databases.
To mitigate the threat, Google recommends security teams: reduce administrative internet exposure, harden application management interfaces and restrict identifies and keys.
