AI-Driven Espionage at Scale: Vapor Panda Turns the ARTEX Framework on 200+ Organizations

A China-linked espionage group has shown what happens when autonomous AI agents are handed a target list. Since mid-October 2026, the actor tracked as Vapor Panda has used an LLM-driven intrusion framework called ARTEX against more than 200 organizations on four continents, with a single human operator supervising swarms of AI agents rather than running each break-in by hand.

What happened

Vapor Panda, previously tracked as VexatiousTemper and overlapping with the cluster known as Earth Estries, has been active since early 2021 and has long focused on quiet, persistent access to government and telecom networks. What changed on 17 October 2026 is the tempo. Within roughly two weeks the group's agents were working against:

• foreign ministries in Latin America, Central America, Europe and Asia, and an interior ministry in the Middle East;
• a European country's foreign ministry, presidency and prime minister's office, plus its defense, justice, finance and intelligence bodies;
• 19 US organizations in the pharmaceutical, semiconductor, defense, nuclear and financial sectors;
• telecommunications providers in the United States, Belgium and the Philippines.

Post-exploitation activity has been confirmed at nine of those organizations, where the group deployed BLOODALCHEMY, a backdoor derived from ShadowPad, and followed up with credential spraying and internal reconnaissance. At least 12 more organizations, including US think tanks and European government entities, were hit with password-spraying activity.

How the framework changes the game

ARTEX is a Go-based penetration testing framework that orchestrates several large language models at once. In this campaign it was connected to DeepSeek and to a second, still unidentified commercial model accessed through a paid subscription. Work is split between planner agents, which choose the next objective, and worker agents, which carry it out, so an intrusion can move from initial access to lateral movement with little human input.

The operator stays in the loop, but at a much higher altitude: setting goals, steering agents when they stall and stepping in to evade endpoint defenses. The agents try several attack paths in parallel across web applications, cloud services, container platforms, Active Directory, mail and VPN, and when one path fails they simply switch to another. The scale is startling: in a single intrusion, the planning agents alone consumed on the order of 1.4 billion input tokens.

Nothing in the group's toolbox is novel. The agents leaned on old, familiar weaknesses: authentication keys that had not been rotated for years, loosely validated identity federation, exposed internal services without authentication, and VPN material recovered from old mailboxes. The novelty is purely economic. A small team can now run dozens of engagements concurrently, and breadth no longer costs the attacker proportionally more people.

ARTEX has spread fast among threat actors, enough that its developer, known as Autumn-27, has since taken the project closed source. It will not be the last tool of its kind.

A wider wave of China-linked activity

The same disclosure window brought four previously undocumented China-linked clusters into view: Hollow Panda, Overcast Panda, Titan Panda and Veiled Panda. Overcast Panda is associated with close-access operations in which its FlowCloud backdoor is planted on travellers' devices while they are physically in China, giving the operators keylogging, screen capture and credential harvesting. Titan Panda has been targeting law firms since at least April 2026 through a hard-coded machine key in a legal time-tracking product, then deploying an in-memory toolkit called IceGiant. How those default keys were obtained remains unknown.

What to do

The ARTEX playbook rewards organizations that leave old doors open. Practical priorities:

1. Rotate long-lived secrets. Signing keys, API keys, VPN certificates and service-account credentials older than a year are exactly what an agent tries first.
2. Harden identity federation. Enforce strict signature validation on single sign-on assertions and reject anything unsigned or weakly signed.
3. Keep cloud metadata and control planes private. Require the hardened metadata service version, and never expose orchestration or container APIs without authentication.
4. Audit Active Directory privileges. Review delegation settings and tightly restrict who can read local administrator passwords.
5. Enforce MFA on VPN and mail and alert on slow, distributed authentication failures across many accounts.
6. Replace default machine keys in any IIS application and keep ViewState integrity checks enabled.

Above all, know your own perimeter better than an autonomous agent does. Every target in this campaign was found by agents probing exposed web applications, cloud endpoints, VPN gateways and mail infrastructure in parallel. Continuous Attack Surface Management, the kind our team runs for clients, maps that same surface from the outside and flags the forgotten host or unrotated key before a planner agent schedules it as its next task.