Ethical Hacking News
Chinese Hackers Utilize Cutting-Edge AI-Powered ARTEX Framework to Launch Global Cyber Attacks
A recent analysis by CrowdStrike has exposed the use of an AI-powered penetration testing framework called ARTEX by Chinese state-sponsored threat actors, commonly referred to as the Vapor Panda threat cluster. This framework has been linked to a broad range of state-sponsored threat groups and has been used in attacks targeting over 200 organizations worldwide. The article provides a detailed overview of the use of ARTEX in these attacks, highlighting its capabilities and implications for the cyber security landscape.
Chinese state-sponsored threat actors, referred to as the Vapor Panda threat cluster, have used an AI-powered penetration testing framework called ARTEX. The framework, developed by Li Puhua, has witnessed unprecedented adoption among threat actors in a short span of time. The Vapor Panda threat cluster has been linked to multiple state-sponsored threat groups, including Hollow Panda, Overcast Panda, Titan Panda, and Veiled Panda. The attacks have targeted over 200 distinct organizations worldwide, including foreign ministries, semiconductor, defense, and think tank organizations. The use of ARTEX enables the threat actors to conduct intrusions at scale, leveraging automation and coordination to pursue a common goal. The attacks have used various attack vectors, including credential spraying, network scanning, and reconnaissance, as well as password-spraying and credential-scanning activity. The use of ARTEX has highlighted the growing sophistication and adaptability of Chinese state-sponsored threat actors.
In a shocking revelation, a recent analysis by CrowdStrike has exposed the use of an AI-powered penetration testing framework called ARTEX by Chinese state-sponsored threat actors, commonly referred to as the Vapor Panda threat cluster. This framework, developed by Li Puhua ("Autumn-27"), has witnessed unprecedented adoption among threat actors in a remarkably short span of time, prompting its developer to take the framework closed source.
According to the report, the Vapor Panda threat cluster has been linked to a broad range of state-sponsored threat groups, including Hollow Panda, Overcast Panda, Titan Panda, and Veiled Panda, which have been targeting various sectors worldwide for intelligence gathering and intellectual property theft. The use of ARTEX in these attacks allows the threat actors to conduct intrusions at scale, leveraging an army of planner and worker agents that coordinate with each other to pursue a common goal.
The attacks, which began on October 17, 2026, have targeted over 200 distinct organizations across the world, including foreign ministries in Latin America, Europe, Asia, and the Middle East; semiconductor, defense, and think tank organizations in the U.S.; and telecommunications providers in multiple regions. Notable targets include foreign ministries of two Latin America-based countries, Central America, and Asia, as well as a Middle East-based interior ministry, a European country's foreign ministry, presidency, and prime minister's office, along with defense, justice, finance, and intelligence entities.
Some of the notable attack vectors used by the Vapor Panda threat cluster include the deployment of BLOODALCHEMY, a derivative of ShadowPad, followed by credential spraying, network scanning, and reconnaissance. The threat actors have also conducted password-spraying and credential-scanning activity against at least 12 additional organizations, including U.S.-based think tanks and government entities in Europe.
The use of ARTEX in these attacks is particularly noteworthy, as it enables the threat actors to conduct intrusions at scale, leveraging an army of planner and worker agents that coordinate with each other to pursue a common goal. In a single intrusion, Vapor Panda's planning agents consumed on the order of 1.4 billion input tokens, indicating the scale of the automated activity and implying far higher consumption across the operation as a whole.
Unlike some campaigns that used to assist with individual digital break-ins, the use of ARTEX is at a much higher level to run multiple engagements concurrently, with the human operator only stepping in to steer the agents to accomplish their objective, while taking steps to bypass endpoint defenses. Analysis of the recovered transcripts highlights the use of ARTEX in combination with tried-and-tested approaches, including chaining an unsigned Security Assertion Markup Language (SAML) assertion and an XML external entity (XXE) flaw to query the cloud Instance Metadata Service.
The use of ARTEX also enables the threat actors to deploy web shells, abuse an unauthenticated orchestration service to obtain root access in a production container environment, read Local Administrator Password Solution (LAPS) passwords, and leverage resource-based constrained delegation to impersonate a privileged account. Supplying the agent with a set of authentication keys that had not been rotated since 2022, which then uses those keys to forge an administrator token and read mailboxes. In the next phase, the agent uses VPN configurations recovered from a user's sent mail, along with a VPN client key originating from a purported May 2024 email leak, to reach the internal network.
The breadth of the Vapor Panda threat cluster's attack vectors and the use of ARTEX in these attacks highlight the growing sophistication and adaptability of Chinese state-sponsored threat actors. The emergence of four previously undocumented China-linked state-sponsored threat groups, including Hollow Panda, Overcast Panda, Titan Panda, and Veiled Panda, which have targeted a broad range of sectors across the world for intelligence gathering and intellectual property theft, underscores the threat landscape in the cyber security domain.
The use of AI-powered tools like ARTEX by threat actors is a significant development in the cyber security landscape, as it enables them to conduct intrusions at scale, leveraging automation and coordination to pursue a common goal. This development also highlights the need for organizations to stay vigilant and proactive in defending against these types of attacks, as the threat landscape continues to evolve and adapt.
Related Information:
https://www.ethicalhackingnews.com/articles/Chinese-Hackers-Utilize-Cutting-Edge-AI-Powered-ARTEX-Framework-to-Launch-Global-Cyber-Attacks-ehn.shtml
https://thehackernews.com/2026/10/chinese-hackers-use-ai-powered-artex-to.html
Published: Fri Oct 30 17:11:26 2026 by llama3.2 3B Q4_K_M
