ARTEX AI hacking framework spreads to another China-linked group

A China-linked hacking group used an open-source AI attack framework to target more than 200 organisations worldwide in less than a fortnight, security vendor CrowdStrike said.

The security vendor said the group it tracks as VAPOR PANDA began using the ARTEX framework on October 17, targeting foreign ministries, United States semiconductor, defence and think tank organisations, and telecommunications providers across several regions.

CrowdStrike confirmed post-exploitation activity at nine organisations, where attackers deployed a backdoor and conducted credential spraying, network scanning and reconnaissance.

It is the latest of three prominent ARTEX campaigns publicly detailed by security researchers in October, following Microsoft's identification of the framework in attacks by China-aligned actor Storm-0940 and CrowdStrike's earlier discovery of its use against South Korean financial institutions.

CrowdStrike said the South Korean attacks were likely the work of a China-based individual rather than a confirmed state-linked group.

ARTEX's developer, a GitHub user known as Autumn-27, withdrew the original code in October because of its misuse, Google Threat Intelligence Group (GTIG) and Mandiant said.

However, copies continue to circulate, including localised versions and a commercial edition called ARTEX PRO.

Harness with BYO model

ARTEX is not an AI model itself, but a harness.

This is software wrapped around a large language model (LLM), giving it tools such as a command shell, a shared record of discoveries, and a planner that breaks an intrusion into tasks for multiple agents.

The documentation for ARTEX suggests it can connect to models from Anthropic and OpenAI, or to any service that uses the latter company's programming interface, meaning operators are not tied to a single AI provider.

VAPOR PANDA ran ARTEX primarily on China's DeepSeek, alongside a second commercial model CrowdStrike could not identify.

A human operator remained in control, issuing instructions in Mandarin.

CrowdStrike said ARTEX's planning agents consumed roughly 1.4 billion input tokens during a single intrusion.

Meanwhile, Microsoft has attributed the ConnectWise Cloud Backup compromise to Storm-0940, a separate China-aligned group that used ARTEX to speed up its attacks.

In several cases, Storm-0940 went from initial targeting to privileged cloud access in under three hours, Microsoft said.

ARTEX used by state hackers and 'skids'

Google's threat intelligence researchers have also observed ARTEX execution sequences lasting seconds, including one that generated 27 events in 23 seconds.

GTIG said it had observed multiple groups, including financially motivated extortion crews, using ARTEX in incident response cases since late August.

The researchers also named HexStrike AI among the open-source frameworks it has seen threat actors abuse in incident response engagements.

HexStrike connects AI models to more than 150 security tools and drew attention last year when attackers on underground forums claimed to have used it against Citrix NetScaler vulnerabilities within hours of their disclosure.

"HexStrike allows AI to think strategically about cybersecurity and executes intelligently through those tools,” Muhammad Osama, creator of HexStrike AI, told iTnews at the time.

On its part, GTIG said "this [AI assisted hacking] represents a paradigm shift towards intrusions occurring at machine speed, with the automated chaining of complex attack paths scaling intrusions exponentially".

“AI-powered frameworks are legit. I've looked at the hard evidence myself,” Rohit Nambiar, one of the GTIG report's authors, said.

“This campaign? It is a warning shot. It’s unsophisticated skids firing into the sky to see what would happen,” Nambiar said of the activity in Google’s report, using security industry slang for script kiddies, or low-skilled attackers.

“We have no evidence that fully autonomous (aka human out of the loop) is here yet,” Nambiar said.

Mandiant added that the underlying techniques have not changed, with attackers still relying on stolen credentials and unpatched systems.

Furthermore, the ARTEX framework is not particularly stealthy, leaving its own name in file and account names and generating hundreds of log entries through trial and error.

The security vendor's advice is to use short-lived credentials, apply tighter control of exposed administrative interfaces, and monitor for unusual bursts of activity from accounts and applications.