CrowdStrike says a China-nexus group it tracks as Vapor Panda has used an AI-driven penetration-testing suite called ARTEX AI against more than 200 organizations in 14 countries since October 17, BleepingComputer reported on November 2.
At least nine organizations were compromised. CrowdStrike also saw password spraying and credential scanning against at least 12 other high-value targets. Sectors include government ministries, telecommunications, pharmaceuticals, semiconductors, defense, nuclear and finance. Confirmed victims include telecom providers in the US and Belgium, government entities in Greece, the Middle East and Latin America, and US pharmaceutical firms.
ARTEX AI is a multi-agent framework. It was first released as open source and later made proprietary by its creators after real-world abuse, including a campaign against South Korean financial institutions. In this campaign, DeepSeek and a second, unidentified commercial language model coordinated planning and worker agents. Operators issued instructions in Chinese and stepped in at key decision points. The agents handled reconnaissance, exploitation, web shell deployment and credential theft, and switched to alternative attack paths when blocked. Researchers estimate one intrusion consumed over 1.4 billion input tokens.
The Dutch Institute for Vulnerability Disclosure (DIVD) was itself breached in September. DIVD attributes the intrusion to an autonomous agent running ARTEX AI. It went from initial access to root in 12 minutes by chaining a Zammad zero-day with a second zero-day for local privilege escalation. The agent then read a compromised mailbox, scanned the internal network, extracted login tokens and attempted password resets. DIVD logged over 450,000 requests and 2,500 scripts, and called the activity "super loud and messy."
In the Greek government intrusion, the agents forged an administrator token and read mailboxes using authentication keys from a 2022 mail-server directory export. CrowdStrike also reports the BLOODALCHEMY backdoor, active since 2023, against government targets in Latin America and the Middle East.
Operators reportedly told the agents to skip Windows machines protected by CrowdStrike Falcon and go after unprotected hosts. Coverage gaps are the path of least resistance, and automation finds them fast.
Why it matters: the DIVD case shows an agent chaining two zero-days to root in 12 minutes. Speed is the change. The noise is also a detection opportunity: 450,000 requests is not subtle.
Recommended mitigation: BleepingComputer's report does not include CVE IDs, indicators or vendor guidance for the Zammad flaws. Until they are published, review the CrowdStrike Vapor Panda write-up and DIVD's disclosure. Defenders should inventory and patch internet-facing helpdesk and mail systems, and close endpoint-sensor coverage gaps. They should also alert on high-volume request bursts and scripted token extraction, rotate keys from old directory exports, and enforce MFA against password spraying.
