China linked group VAPOR PANDA uses ARTEX AI framework in global campaign

A China-linked hacking group targeted more than 200 organisations worldwide within two weeks using an open-source artificial intelligence framework, iTnews reported. Cybersecurity firm CrowdStrike identified the group behind the campaign as VAPOR PANDA, which began using the ARTEX framework on October 17. [1]

According to iTnews, the campaign targeted foreign ministries, telecommunications providers, think tanks, and United States semiconductor and defence organisations across several regions. CrowdStrike confirmed post-exploitation activity at nine of the targeted organisations, where the hackers deployed a backdoor, scanned networks, and performed credential spraying. [1]

The ARTEX framework is a Go-based tool that uses AI agents to scale intrusion operations, as FTMQ Security reported earlier. In a previous breach, a China-aligned group known as Storm-0940 used the same agentic AI framework during a supply chain attack that affected over 2,200 Microsoft 365 tenants connected to ConnectWise. [4][5]

By definition, a hacker is an individual who seeks unauthorized access to a computer system or network, or a skilled specialist who evaluates digital security systems. The latest activity represents one of three prominent campaigns involving the ARTEX framework that security researchers have publicly detailed. [1][3]