AI-powered hacking goes global as Chinese groups use ARTEX to automate cyber espionage

Hacker groups connected to China are increasing their attacks with the help of an AI-driven penetration testing technology named ARTEX. According to CrowdStrike, Vapor Panda has been using the tool since October 17, 2026, in its attacks against over 200 organizations worldwide. Much of the work is done by AI while the final decision-making is performed by humans.

Planner and worker agents that pursue many paths at once

ARTEX relies on one main agent for managing “planner” agents that plan attacks and the “worker” agents that execute them. The agents work together to share findings as they scan systems, exploit vulnerabilities, and navigate networks. Based on the information provided by CrowdStrike, Vapor Panda used DeepSeek along with an unknown commercial AI system. During just one attack, the planner agents used 1.4 billion input tokens.

The campaign reached at least 14 countries. Targets included foreign ministries and telecom providers. In the US, attackers went after 19 organizations across the pharmaceutical, semiconductor, defense, nuclear, and financial sectors.

However, just because the operation was grand in scale, it did not mean that all of its attacks were successful. CrowdStrike confirmed post-exploitation activities at only nine companies, including the use of the BLOODALCHEMY backdoor. Human operators subsequently took over by creating web shells, extracting passwords, and locating unprotected machines.

From ConnectWise to Microsoft 365, a second group scales up

ARTEX was also being used by Storm-0940, another hacking group linked to China. According to Microsoft, the group began using the tool as early as September 2026. It targeted hundreds of organizations and gained privileged cloud access in under three hours in several cases. Microsoft also linked the group to the ConnectWise Cloud Backup compromise.

The magnitude of its attacks was impressive. Microsoft tracked more than 151,000 failed logins from October 10-14 against 327 accounts across eight companies. Hits peaked at 2,900 per minute. However, no successful login was observed.

The ConnectWise compromise was a separate part of the group’s activity. Following that breach, attackers also tried to change cloud-application credentials, as Cryptopolitan previously reported.

A money-driven actor hits South Korean banks

A third ARTEX campaign had a different motive. In late September 2026, attackers used the tool against South Korean financial institutions, Zscaler reported. They stole personal information belonging to about 67,000 people.

Zscaler assessed the attacker as Chinese-speaking and financially motivated, with moderate confidence. It did not confirm any state sponsorship. CrowdStrike also found ARTEX files and Claude Code logs on attacker-controlled systems.

How hacking got agentic

But the move toward automated hacking started well before ARTEX. In 2025, Anthropic uncovered a Chinese state-sponsored campaign that used Claude Code against roughly 30 targets. AI handled an estimated 80–90% of the work.

Google has also documented how attackers are moving beyond simple AI prompts toward autonomous operations. These earlier activities were separate from the ARTEX campaigns, but they show how quickly AI-powered hacking is evolving.

What it could mean for banks, chipmakers and cloud providers

The risks extend beyond the organizations already targeted. Banks face potential customer-data breaches, while chipmakers could lose valuable intellectual property. Cloud providers face another concern: compromised application credentials that could expose multiple customers.

Industry figures show why faster attacks are worrying businesses. Verizon found that system intrusion accounted for 61% of breaches in its 2026 report. Microsoft reported that exposed cloud workloads faced attacks within 5.3 hours on average.

Meanwhile, the World Economic Forum found that 65% of large companies considered third-party and supply-chain vulnerabilities their biggest cybersecurity challenge, up from 54% in 2025.

As attacks become faster and more automated, businesses may shift security spending toward stronger identity controls, faster detection, and closer supplier monitoring.