State-sponsored threat actors used a Go-based AI penetration testing framework named ARTEX to target over 200 organizations.
The tooling integrated LLMs like DeepSeek with agent-based planning and execution, demonstrating large-scale operational use of automated frameworks in cyber campaigns.
The group, known as Vapor Panda, began the campaign on October 17, 2026. It targeted foreign ministries in Latin America, Europe, Asia, and the Middle East, as well as organizations in sectors such as pharmaceuticals, defense, energy, semiconductors, financial institutions, and telecommunications in the United States and other regions. The specific countries affected include the interior ministry of the Middle East, European government agencies, and telecommunications providers in the United States, Belgium, and the Philippines.
How the attack worked
The attackers used an artificial intelligence program called ARTEX, which was based on technologies such as DeepSeek and unknown business models. The system operated with utility programs that planned and executed actions under the supervision of a human operator. In a single intrusion, the program’s designers consumed approximately 1,4 billion input data.
In nine of the organizations, the attack went beyond the initial breach, with the attackers installing special programs, monitoring networks and searching for passwords. They also tried mass passwords at at least 12 additional organizations, including research centers in the United States and European government agencies. The techniques included exploiting vulnerabilities in network services, reading stored administrator passwords and using authentication keys that had been changed since 2022. After the tool became widely available, its developer made it private.
New groups and attacks on legal organizations
Researchers identified the activity of four other groups linked to China: Hollow Panda, Overcast Panda, Titan Panda, and Veiled Panda.
↳
READ ALSO
HACKS.GR / RELATED
Cyber Attacks & Data Breaches
Developer app hacked and secretly installed dangerous software
↗
Overcast Panda secretly installed surveillance programs directly on target devices via physical access in China, using legitimate service infrastructure to control the devices. Titan Panda, for its part, targeted law firms in North America starting in April 2026, exploiting a flaw in billing software used by law firms to install programs on their systems.
G
HACKS.GR / GOOGLE SEARCH
Hacks.gr on Google
Set Hacks.gr as a preferred source.
Preferred source
↗
end of article
Top comments (0)