Overview: What’s going on?

Okay, grab your tinfoil hat and a cup of coffee — a China-linked hacking crew has been using an AI-driven pentesting framework to run a massive, automated campaign against hundreds of targets. The group, tracked under the nickname Vapor Panda, started cranking the engine on October 17, 2026, and in short order the tool was pointed at more than 200 organizations across the globe.

At the center of this mess is an agentic toolkit called ARTEX that coordinates planner and worker agents to do reconnaissance, exploitation attempts, and lateral movement — all while a human operator quietly nudges the operation toward goals like planting web shells or stealing privileged credentials. CrowdStrike’s analysis noted that in a single intrusion the planners burned through roughly 1.4 billion input tokens, which is a fancy way of saying the system was working at industrial scale.

Targets were wide and not picky: government ministries, defense and semiconductor firms, think tanks, telcos — the usual buffet for intelligence-gathering actors. Here are some of the categories called out:

  • Foreign ministries in Latin America, Central America, and Asia
  • An interior ministry in the Middle East
  • A European country’s foreign ministry, presidency, and prime minister’s office plus several national agencies
  • 19 U.S. organizations across pharmaceuticals, semiconductors, defense, nuclear and finance
  • Telecommunications providers in the U.S., Belgium, and the Philippines

How they pulled it off — techniques, other groups, and the fallout

ARTEX doesn’t act alone. It was used alongside a search/analysis tool called DeepSeek and a commercial large language model subscription to choreograph adversary moves. The agents ran many attack paths in parallel and pivoted when something failed — basically multitasking on steroids. A human kept an eye on things and issued high-level commands, but the heavy lifting was automated.

Post-compromise activity was observed at multiple victims: operators pushed a ShadowPad-derived implant known as BLOODALCHEMY, performed credential spraying and scanning, ran network scans, and collected reconnaissance data. At least nine organizations showed evidence of post-exploitation, while a dozen more experienced password-spraying and credential enumeration efforts.

Some of the specific tradecraft that came up in recovered transcripts and forensic work included:

  • Chaining an unsigned SAML assertion with an XML external entity (XXE) flaw to query cloud metadata, then assuming a role that could issue admin commands across numerous instances and escalate to enterprise admin access.
  • Dropping web shells, abusing an unauthenticated container orchestration endpoint to gain root inside a production container, reading Local Administrator Password Solution (LAPS) secrets, and using resource-based constrained delegation to impersonate privileged accounts.
  • Feeding the agents long-lived authentication keys (some not rotated since 2022), forging admin tokens, reading mailboxes, and using recovered VPN configs and leaked client keys to hop into internal networks.

Beyond ARTEX and Vapor Panda, the broader landscape includes several other China-linked clusters now documented by investigators — groups with names like Hollow Panda, Overcast Panda, Titan Panda, and Veiled Panda. One particularly sneaky tool associated with close-access intrusions is called FlowCloud, which is installed via DLL sideloading after an adversary has physical access to a target device. FlowCloud aims to be furtive: keylogging, screen capture, data collection, and command-and-control over legitimate cloud services to hide in plain sight.

Titan Panda has its own quirks: investigators tied it to attacks against legal billing software, exploiting a default IIS machine key in an application to run remote code and then loading an in-memory framework called IceGiant for reconnaissance and exfiltration. These campaigns show that attackers still mix old-school hands-on techniques with shiny new AI-driven orchestration.

Bottom line: a small, skilled team plus agentic AI tooling equals scale. When the planners and workers are automated, a single human can supervise many simultaneous break-ins, which complicates defenders’ jobs. If you run critical infrastructure or handle sensitive data, now’s a great time to rotate keys, tighten SAML/XML handling, and review container and orchestration access controls — or at least stock up on coffee.