[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ffPo1_mJk4JTFN1H_NiYFrXSHiiftcpt29yAm40pbzZQ":3},{"article":4,"iocs":55,"watch_terms":60,"solutions":61,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"919ec037-8a47-45be-8971-4be65b99f35f","Chinese hackers use ARTEX AI in automated attacks against 200 orgs","chinese-hackers-use-artex-ai-in-automated-attacks-against-200-orgs-6c6aea","Chinese hackers used ARTEX, an open-source, multi-agent AI penetration-testing framework, in attacks against more than 200 organizations across 14 countries. [...]","Chinese threat actor Vapor Panda has been observed using the open-source, multi-agent AI penetration-testing framework ARTEX in sophisticated attacks against over 200 organizations across 14 countries. The campaign, which began in October 2026, targeted critical sectors including government, telecommunications, and pharmaceuticals, with at least nine organizations confirmed compromised. The AI agents demonstrated autonomous capabilities, performing reconnaissance, exploiting vulnerabilities, and deploying backdoors, while operators provided high-level direction.","Chinese hackers leverage ARTEX AI framework in automated attacks against over 200 organizations.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fchinese-hackers-use-artex-ai-in-automated-attacks-against-200-orgs\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F11\u002F02\u002Fpandabot.jpg","2026-11-02T21:40:14+00:00","2026-11-02T22:00:23.841372+00:00",9,[17,20,23,25,27,30],{"name":18,"type":19},"Vapor Panda","threat_actor",{"name":21,"type":22},"ARTEX","product",{"name":24,"type":22},"DeepSeek",{"name":26,"type":22},"Falcon",{"name":28,"type":29},"CrowdStrike","vendor",{"name":31,"type":22},"Zammad","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":34,"name":35,"slug":36},null,"Nation-state","nation-state",[38,40,45,50],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56],{"type":57,"value":58,"context":59},"malware","BLOODALCHEMY","Backdoor deployed by Vapor Panda against government entities.",[28,21,24],{"controls":62,"vendors":149},[63,91,120],{"slug":64,"name":65,"problem":66,"products":67},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":85,"vendor_name":28,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"crowdstrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"slug":92,"name":93,"problem":94,"products":95},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":121,"name":122,"problem":123,"products":124},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[125,133,141],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",[150],{"slug":85,"name":28,"logo_path":86,"roles":151},[152],"reported_by",{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":165},"ai-powered-autonomous-attacks-highlight-need-for-proactive-vulnerability-management","AI-Powered Autonomous Attacks Highlight Need for Proactive Vulnerability Management","Chinese threat actor Vapor Panda weaponized an open-source AI penetration-testing framework (ARTEX) to autonomously conduct reconnaissance, exploit vulnerabilities, and deploy backdoors across 200+ organizations — dramatically accelerating the attack lifecycle beyond what human-paced defenses can match. The root problem is that targeted organizations failed to identify and remediate exploitable vulnerabilities before AI-driven agents could discover and chain them together autonomously. This matters because AI-assisted attacks compress the window between vulnerability disclosure and exploitation to near-zero, making reactive patching strategies obsolete. Organizations that lack continuous monitoring and mature vulnerability management programs are now exposed not just to skilled human hackers, but to tireless automated agents operating at machine speed.",[158,159,160,161,162,163,164],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1566: Phishing","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":166,"MITRE ATT&CK T1566: Phishing":167,"NIST SP 800-53 SI-2: Flaw Remediation":168,"CIS Control 17: Incident Response Management":169,"CIS Control 7: Continuous Vulnerability Management":170,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":171,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":172},"NIS2 requires operators of essential services — including government and telecommunications sectors targeted here — to implement incident handling and vulnerability management measures, which would have mandated the security hygiene that could have detected or slowed this campaign.","While ARTEX focused on autonomous exploitation, AI-assisted campaigns frequently use phishing as an initial access vector; mapping defenses to ATT&CK enables organizations to anticipate and detect the full kill chain used by groups like Vapor Panda.","SI-2 requires organizations to identify, report, and correct information system flaws promptly — enforcing this control would have reduced the pool of exploitable weaknesses available to Vapor Panda's AI agents.","With at least nine organizations confirmed compromised before the campaign was publicly disclosed, a mature incident response capability with predefined AI-attack playbooks would have enabled faster containment and reduced the overall blast radius.","ARTEX agents autonomously identified and exploited unpatched vulnerabilities; a continuous vulnerability management program with mandatory remediation timelines would have closed these gaps before automated attackers could leverage them.","This control mandates timely identification and remediation of technical vulnerabilities — had targeted organizations complied, the exploitable attack surface leveraged by ARTEX's autonomous agents would have been materially reduced.","Autonomous backdoor deployment relies on acquiring or abusing credentials and access paths; strong identity and access management under PR.AA would have limited the agents' ability to escalate privileges and persist in compromised environments."]