ARTEX AI hacking framework spreads to another China-linked group

What happened

The security vendor said the group it tracks as VAPOR PANDA began using the ARTEX framework on October 17, targeting foreign ministries, United States semiconductor, defence and think tank organisations, and telecommunications providers across several regions. CrowdStrike confirmed post-exploitation activity at nine organisations, where attackers deployed a backdoor (a hidden way into a system that bypasses its login) and conducted credential spraying, network scanning and reconnaissance. CrowdStrike is a computer security company based in Austin.

CrowdStrike said the South Korean attacks were likely the work of a China-based individual rather than a confirmed state-linked group. Open-source ARTEX framework linked to espionage and financially motivated campaigns.

Home News Technology Security By Juha Saarinen Nov 2 2026 6:57AM Open-source ARTEX framework linked to espionage and financially motivated campaigns. Key points China-linked group VAPOR PANDA used the open-source ARTEX framework to target more than 200 organisations worldwide in under a fortnight, CrowdStrike said.

ARTEX acts as a harness wrapping tools around large language models such as DeepSeek, letting a human operator in Mandarin direct intrusions using roughly 1.4 billion input tokens. GTIG's Rohit Nambiar called the campaign a warning shot from unsophisticated 'skids', noting there is no evidence fully autonomous, human-out-of-the-loop hacking exists yet.

A China-linked hacking group used an open-source AI attack framework to target more than 200 organisations worldwide in less than a fortnight, security vendor CrowdStrike said. It is the latest of three prominent ARTEX campaigns publicly detailed by security researchers in October, following Microsoft's identification of the framework in attacks by China-aligned actor Storm-0940 and CrowdStrike's earlier discovery of its use against South Korean financial institutions .