A China-linked hacking group’s use of AI agents to identify security weaknesses during a global espionage campaign is raising concerns about whether enterprises can detect gaps in their defenses before automated attacks exploit them.
CrowdStrike reported that the group, tracked as VAPOR PANDA, used an AI-powered penetration testing framework called ARTEX to target more than 200 organizations worldwide over an 11-day period beginning October 17. The organizations included government agencies and businesses across at least 14 countries, with researchers confirming post-exploitation activity at nine.
At a global pharmaceutical company, the attackers instructed AI agents to examine running processes and folder listings on Windows machines to determine whether CrowdStrike’s Falcon sensor was installed, according to transcripts recovered by the cybersecurity firm.
ARTEX uses multiple AI agents to carry out intrusion tasks under human direction. CrowdStrike found that VAPOR PANDA used the framework to pursue attacks against several organizations simultaneously, with operators intervening at key decision points.
The findings follow an October 21 report from Microsoft detailing a separate campaign involving ARTEX. Microsoft said another China-linked group, Storm-0940, used the framework to automate attacks targeting hundreds of organizations, gaining privileged cloud access in less than three hours in some cases. The campaign included the abuse of compromised ConnectWise application credentials to access customer environments.
Changing economics of cyberattacks
The use of AI in cyberattacks is changing the economics of state-sponsored espionage by allowing smaller teams to pursue targets without a corresponding increase in personnel, according to Akshat Tyagi, associate practice leader at HFS Research.
“The techniques are familiar, but the ability to run them in parallel is not,” Tyagi said.
Jonathan Ong, senior analyst for managed security services at Omdia, said AI can substantially reduce the time attackers spend on reconnaissance, even as more sophisticated exploitation continues to require technical expertise.
The attacks documented by CrowdStrike exploited weaknesses that security teams have encountered for years. At a Greek government organization, attackers used authentication keys from a 2022 directory export that had likely not been rotated. At a US pharmaceutical company, an AI agent combined an unsigned SAML assertion with an XML external entity (XXE) vulnerability to obtain a cloud role with extensive administrative permissions.
Security gaps become a bigger target
Growing concerns about the security risks of AI adoption should not distract organizations from established defensive measures, Ong said. Tyagi added that CISOs should ensure that security monitoring extends across their environments rather than assuming existing deployments provide complete coverage.
Amit Kumar Jena, development manager for AI at Kanerika, said organizations should continuously measure endpoint protection coverage, including on internal servers, and generate alerts when machines stop reporting to security monitoring systems.
He also recommended enforcing SAML signature validation and restricting cloud access privileges. Security teams should watch for closely sequenced authentication attempts and commands that could indicate automated malicious activity, he said.
Tyagi also recommended regularly rotating credentials and monitoring unusual account activity, warning that automated attacks leave defenders less time to investigate suspicious behavior.
Keith Prabhu, CEO of Confidis, said gaps between security systems could give attackers opportunities to move through enterprise environments. He recommended improving asset visibility and detecting suspicious activity across systems rather than relying on individual security controls.
Prospect of Cobalt Strike-style adoption
The use of ARTEX by different threat groups also points to the wider availability of tools capable of automating cyberattacks.
CrowdStrike said VAPOR PANDA used ARTEX with DeepSeek and a second commercial AI model. Although the framework’s developer withdrew the original open-source project in October following reports of its misuse, copies and modified versions remain available.
Tyagi expects such tools to become more widely adopted by financially motivated cybercriminals over the next 12 months.
There is already evidence of broader adoption. In research published in October, Google Threat Intelligence Group and Mandiant said they had observed financially motivated attackers using ARTEX during data-theft extortion operations, alongside its use by suspected state-linked groups.
“AI pentesting frameworks such as ARTEX have the potential to become the Cobalt Strike of the AI era,” said Ong.
Cobalt Strike, a commercial penetration-testing tool, has been widely abused by cybercriminals and state-sponsored groups.
As attackers automate more of their operations, security teams may need to rely more heavily on automated detection. Tyagi said this would allow analysts to spend less time manually reviewing alerts and concentrate on decisions requiring human judgment.
Prabhu said CISOs should prioritize faster, rehearsed incident response rather than simply investing in additional AI tools or expanding security teams. Such preparations could help security teams respond to intrusions in which automated agents explore multiple attack paths before defenders have completed their initial investigation.
Although ARTEX can automate much of an intrusion, the observed campaigns still involved human operators directing key decisions.
“We are not at fully autonomous attacks yet,” Tyagi said.
The continuing role of human operators does not diminish the speed of the attacks. For security teams, the challenge is detecting suspicious activity early enough to prevent automated intrusion attempts from developing into broader compromises.