AnswersPublished23 sources
ARTEX and AI-Assisted Hacking: What the China-Linked Campaigns Show
CrowdStrike reported that VAPOR PANDA used ARTEX to target more than 200 organizations across at least 14 countries in 11 days; post exploitation activity was confirmed at nine. Microsoft also linked ARTEX to Storm 0940’s ConnectWise related activity, while Google and Mandiant describe wider abuse of agentic offensi...
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer
Key takeaways
- CrowdStrike reported that VAPOR PANDA used ARTEX to target more than 200 organizations across at least 14 countries in 11 days; post exploitation activity was confirmed at nine.
- Microsoft also linked ARTEX to Storm 0940’s ConnectWise related activity, while Google and Mandiant describe wider abuse of agentic offensive frameworks.
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What do CrowdStrike’s October 29, 2026 report and findings from Google Threat Intelligence Group, Mandiant, Microsoft and Trend Micro reveal. Article summary: The available evidence shows ARTEX spreading across China-linked operations as a tool for automating and scaling intrusion work, rather than demonstrating an attacker that operates entirely without people. Reporting link. Topic tags: general, general web, user generated. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fa
ARTEX has appeared in multiple China-linked operations, including a VAPOR PANDA campaign that targeted more than 200 organizations in 11 days and Storm-0940 activity tied by Microsoft to a ConnectWise-related compromise. The reports point to AI agents helping attackers scale and coordinate work—not to end-to-end hacking without human direction. 9
17
25
What CrowdStrike reported about VAPOR PANDA
CrowdStrike said the campaign began on October 17, 2026, and used ARTEX alongside DeepSeek and a second, unidentified commercial language model. Over 11 days, the group targeted more than 200 organizations in at least 14 countries. The reported targets included foreign ministries, telecommunications providers, and organizations in sectors such as pharmaceuticals, semiconductors, defense and think tanks. 3
9
Targeting is not the same as a confirmed compromise: CrowdStrike reported post-exploitation activity at nine organizations. 3 A separate account says an operator steered the agents’ decisions, underscoring that the campaign involved human oversight.
4
CrowdStrike tracks the group as VAPOR PANDA; reporting describes it as overlapping with Trend Micro’s Earth Estries cluster. That is an overlap in tracking, not necessarily proof that the names are interchangeable in every context. 1
7
ARTEX is spreading beyond one campaign
Microsoft reported that China-state-aligned actor Storm-0940 had used ARTEX as early as September 2026 to automate attacks against hundreds of organizations. Microsoft also attributed the ConnectWise Cloud Backup credential-abuse activity to Storm-0940 using ARTEX. 17
25
Google’s Threat Intelligence Group describes ARTEX as a Go-based, multi-agent, large language model-driven penetration-testing and offensive command-and-control platform with a Next.js web console. Google says it was developed by a GitHub user named Autumn-27 and that its original repository was taken down by its creator in October 2026 after abuse by threat actors. 48
Taking down the original repository did not end its circulation. Google reports that community forks continued to spread, including localized versions such as ScopeWeaver; another report also identifies a commercial version called ARTEX PRO. 47
48
What researchers have observed—and what remains uncertain
Google and Mandiant have reported multiple threat actors abusing agentic penetration-testing frameworks, including ARTEX, in real intrusions across different stages of the attack lifecycle. Other reporting summaries describe activity such as reconnaissance and Kerberoasting, but the available excerpts do not establish that every technique occurred in every ARTEX operation. 35
55
One secondary report puts input-token use in a single intrusion at roughly 1.4 billion. That figure may indicate substantial model processing, but token volume alone does not show how effective or autonomous an operation was. 6
The evidence also argues against equating automated tasks with a fully autonomous intrusion. In the VAPOR PANDA reporting, a human operator steered the agents; Microsoft’s ConnectWise account involves compromised application credentials. These examples show agents assisting and accelerating operations that still rely on human decisions or conventional access paths. 4
17
A Google Threat Intelligence Group researcher characterized the activity as a “warning shot,” according to reporting on the findings. The caution is warranted: ARTEX appears to make it easier to scale attack work, but the public evidence summarized here does not demonstrate a complete campaign conducted without human involvement. Nor should the more than 200 targets in CrowdStrike’s report be read as 200 confirmed compromises. 3
18
The practical takeaway
ARTEX’s significance is its combination of reusable tooling and the ability to automate parts of offensive work across many targets. The reported campaigns show that this can increase operational scale. They do not, on their own, establish that AI has replaced human operators or that every targeted organization was breached. 3
4
25
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "ARTEX and AI-Assisted Hacking: What the China-Linked Campaigns Show"?
CrowdStrike reported that VAPOR PANDA used ARTEX to target more than 200 organizations across at least 14 countries in 11 days; post exploitation activity was confirmed at nine.
What are the key points to validate first?
CrowdStrike reported that VAPOR PANDA used ARTEX to target more than 200 organizations across at least 14 countries in 11 days; post exploitation activity was confirmed at nine. Microsoft also linked ARTEX to Storm 0940’s ConnectWise related activity, while Google and Mandiant describe wider abuse of agentic offensive frameworks.
Sources
crowdstrike.comVAPOR PANDA Uses AI-Driven ARTEX to Scale a Global ...
huntress.comAI, Scripts, Operator: Inside the ConnectWise Attack
microsoft.comAI-driven, large-scale nation-state campaign using ARTEX ...
insurewire.orgCrowdStrike says China-nexus group used AI agents against more than 200 organisations in 11 days | insurewire.org