China-nexus Vapor Panda used agentic AI tool ARTEX on 200+ targets

CrowdStrike, in a report published October 29, says a China state-backed group it tracks as Vapor Panda ran an espionage campaign driven by an agentic-AI penetration-testing framework called ARTEX, hitting more than 200 organizations in at least 14 countries since October 17. The capability claims deserve a close read, and the gap between "targeted" and "confirmed compromised" is where to keep your skepticism.

What CrowdStrike attributes

Attribution is CrowdStrike's; the article does not cite independent confirmation of the actor call. The firm describes ARTEX as an automated agentic framework pairing planner and worker agents, orchestrating multiple LLM backends — DeepSeek is named, alongside an unidentified commercial model. A human operator oversees the agents and directs them to write web shells, extract domain-admin credentials, and work past endpoint defenses. The Hacker News adds that ARTEX is a Go-based tool whose developer, Li Puhua ("Autumn-27"), has taken it closed source, and that Zscaler ThreatLabz has analyzed it separately.

The velocity numbers are the headline: CrowdStrike says hands-on-keyboard intrusions historically ran up to ~40 commands an hour, while ARTEX could exceed 1,500 commands an hour, issuing requests as often as every 10 seconds across concurrent attack paths. One intrusion's planning agents reportedly consumed on the order of 1.4 billion input tokens.

Scale — read the two numbers

This is the part to hold at arm's length. CrowdStrike's figures: 200+ organizations targeted, ~140 "sensitive targets" compromised in 11 days, and about 70% confirmed compromised or assessed at moderate confidence. The firmer, independently described figures are smaller — The Hacker News reports post-exploitation confirmed at nine organizations, plus password spraying and credential scanning against at least 12 more. "Targeted 200+" and "confirmed compromise at nine" are both true and describe very different things; a vendor's moderate-confidence tally is not the same as a verified breach count.

Who was hit

Per the reporting: foreign ministries across Latin America, Central America, Asia, Europe, and the Middle East; a European presidency, prime minister's office, and ministries of defense, justice, finance, and intelligence; a Middle East interior ministry; 19 U.S. organizations in pharmaceutical, semiconductor, defense, nuclear, and financial sectors; U.S. think tanks; and telecom providers in the U.S., Belgium, and the Philippines.

The tradecraft (no CVEs named)

The campaign leaned on configuration and identity weaknesses, not a signature exploit:

• Chaining an unsigned SAML assertion with an XXE flaw to query the cloud Instance Metadata Service, then escalating to an enterprise admin account.
• Deploying web shells and abusing an unauthenticated orchestration service for root in a production container environment.
• Reading LAPS passwords and using resource-based constrained delegation to impersonate a privileged account.
• Forging an admin token with authentication keys unrotated since 2022 to read mailboxes.
• Reaching the internal network via VPN configs pulled from a user's sent mail and a VPN client key from a purported 2024 email leak.

Action checklist

1. Rotate long-lived keys and tokens. The 2022-vintage signing keys are the whole ballgame on the mailbox-access path — audit token-signing and service-account credentials for anything that hasn't rotated.
2. Harden the SAML/IMDS chain. Enforce signed SAML assertions, kill XXE in document parsers, and put IMDSv2-style hop limits in front of metadata services.
3. Watch command velocity. 1,500 commands an hour is not a human — alert on anomalous command and request rates per session.
4. Monitor LAPS reads and RBCD changes. Both are high-signal when they are abused.
5. Review VPN config exposure in mailboxes. Treat VPN profiles and client keys in mail as credentials.

Context

This is the operational follow-through on a trend we flagged with Anthropic's exploit-chain research and the CyberXero / PentAGI tooling: AI is compressing the time and headcount an espionage operation needs, and the defensive answer is boring — rotate credentials, close identity gaps, watch for inhuman tempo. Note too that Microsoft attributed a different ARTEX-linked campaign to Storm-0940 (a ConnectWise supply-chain intrusion); CrowdStrike says the Vapor Panda activity is distinct. The tool is shared; the operators are not.