What happened. CrowdStrike says a China-nexus espionage group it tracks as VAPOR PANDA used ARTEX, an open-source AI agent framework built for penetration testing, against more than 200 organizations in at least 14 countries, starting October 17. Targets included foreign ministries, one European country’s presidency and prime minister’s office, 19 U.S. pharmaceutical, semiconductor, defense, nuclear and financial organizations, and telecom providers in the U.S., Belgium and the Philippines.
How it works, in plain words. ARTEX isn’t a model. It’s a harness: software that gives a large language model a command shell, a shared notebook of what it has found, and a planner that splits an intrusion into jobs for several agents. VAPOR PANDA ran it mostly on DeepSeek, plus a second commercial model CrowdStrike couldn’t identify. A human stayed in charge, typing instructions in Chinese and stepping in at decision points. In a single intrusion, the planning agents consumed on the order of 1.4 billion input tokens.
The number that matters. CrowdStrike’s Adam Meyers told CyberScoop that human, hands-on-keyboard intruders typically run up to 40 commands an hour. With ARTEX, CrowdStrike saw activity exceed 1,500. That isn’t a smarter attacker. It’s a cheaper one. One operator can keep many break-ins moving at once and only look up when the agents get stuck.
How bad was it? Read the counts carefully. CrowdStrike’s own blog says it confirmed post-exploitation, meaning the attacker got in, planted a backdoor and kept working, at nine organizations, with password spraying against at least 12 more. Separately, CrowdStrike told CyberScoop that about 70% of targets were confirmed compromised or showed moderate-confidence evidence of intrusion, which CyberScoop reported as about 140. Those measure different things, at different confidence levels. Either way, it’s a lot for 11 days.
The line that should change your week. At a global pharmaceutical company, the operator told the agents, in Chinese, to find Windows machines in the domain without Falcon, judging by the process list and folder names. Falcon is CrowdStrike’s endpoint sensor. The attacker built a coverage check into the workflow. The agents weren’t trying to beat the sensor. They were looking for where it wasn’t.
My take. We’ve spent two years debating whether AI will invent new attacks. This report points at an older problem. AI makes your existing security debt payable at machine speed. Look at what the agents actually used. An unsigned SAML assertion (SAML is the token that tells an app “this user already signed in”). An XML parsing flaw used to query the cloud metadata service and grab a powerful role. An unauthenticated container orchestration service. And at a Greek government body, mail-server keys from a 2022 directory export that had likely never been rotated. None of that is novel. All of it is the backlog that sits because “nobody will find it.” Agents find it, because checking everything costs them almost nothing.
The market read. This is the strongest case yet for treating coverage as a board metric. Yes, CrowdStrike ends its recommendations by telling you to deploy its sensor everywhere. Discount the pitch, keep the point. Boards ask, “Do we have EDR?” The better question is, “What percentage of servers, including the ones we think are unreachable, actually run it, and how fast would we know if that number dropped?” Same for identity: how many signing keys and service credentials are older than your last incident?
What to do this week. Pull a sensor coverage report and close the gaps, servers first. Rotate signing keys and service credentials that show up in old backups or directory exports. Enforce SAML signature checks. Require IMDSv2 on AWS, the newer metadata service that blocks this kind of forged request. Hunt for the ARTEX markers CrowdStrike published, including “artx” or “artex” in command lines and the C:\ProgramData\artx5v\ folder. Then assume the next crew already has the same tool. CrowdStrike assesses ARTEX is gaining popularity across multiple China-nexus groups, and Meyers told CyberScoop the company counted roughly 45 agentic adversary attacks in September and 126 in October.