CrowdStrike says the China-based group it calls Vapor Panda (overlapping Trend Micro’s Earth Estries) has been using ARTEX, a Go-based, AI-powered pentest framework, against more than 200 organizations since October 17.
What stands out
- Targets include foreign ministries in Latin America, Europe and Asia, US semiconductor, defense, nuclear and pharma firms, and telecoms in the US, Belgium and the Philippines.
- ARTEX runs planner and worker agents on DeepSeek plus an unnamed commercial LLM to go from initial access to recon and lateral movement.
- One intrusion burned about 1.4 billion input tokens.
- CrowdStrike confirmed post-exploitation at nine organizations, where the group dropped BLOODALCHEMY, a ShadowPad derivative.
My take
CrowdStrike’s point matters: AI didn’t change what these people want, it just lets a small team hit far more targets at once. Defenders need the same scale. Watch for credential spraying and scanning bursts, and get basic hygiene done before the bots find the gaps.
God Bless, and May the Source Be with You!
