Chinese state-sponsored hackers, known by the name Vapor Panda, have been leveraging an advanced AI-powered penetration testing framework called ARTEX to conduct high-speed cyber intrusions. These activities are reportedly targeting over 200 organizations worldwide, including foreign ministries, defense sectors, and telecommunications providers. CrowdStrike has attributed these attacks to Vapor Panda, a group previously identified as Vexatious Temper, which overlaps with threat clusters like Earth Estries.

The ARTEX framework, which is Go-based and employs artificial intelligence, enables small teams to expand their target range significantly compared to traditional manual operations. Starting from October 17, 2026, the group has utilized ARTEX alongside a subscription-based commercial large language model to automate and scale their operations. This has allowed them to perform complex tasks such as writing web shells, extracting domain administrator passwords, and conducting reconnaissance.

The impact of these attacks is significant, with post-exploitation activities confirmed in nine organizations. The attackers have deployed BLOODALCHEMY, a derivative of ShadowPad, followed by credential spraying, network scanning, and reconnaissance. Additionally, password spraying and credential scanning were conducted against 12 more organizations, including U.S.-based think tanks and European government entities.

The widespread adoption of ARTEX among threat actors has led to its developer, Li Puhua, taking it closed source. The tool orchestrates multiple large language model backends to autonomously carry out reconnaissance, vulnerability identification, and exploitation, lowering the technical barrier for complex intrusion campaigns. This development coincides with the emergence of other China-linked state-sponsored threat groups, including Hollow Panda, Overcast Panda, Titan Panda, and Veiled Panda, each targeting different sectors for intelligence gathering and intellectual property theft.