Cyber Insights: Chinese Hackers Use AI Agents to Target More Than 200 Organisations in Global Espionage Campaign
7 Min Read
3rd November 2026
Overview
A Chinese state-linked threat actor known as Vapor Panda has reportedly used an AI-powered penetration-testing framework to launch coordinated cyber-espionage attacks against more than 200 organisations across 14 countries.
According to CrowdStrike researchers, the campaign began on 17 October 2026 and targeted government agencies, telecommunications providers and organisations operating in the pharmaceutical, semiconductor, defence, nuclear and financial sectors.
At least nine organisations were successfully compromised, while a further 12 high-value targets experienced password spraying and credential-scanning activity.
The attackers used a multi-agent AI framework called ARTEX AI, alongside DeepSeek and another commercial large language model, to automate reconnaissance, vulnerability exploitation, credential harvesting and privilege escalation.
The campaign highlights a significant development in cyber-espionage: attackers are increasingly using AI not simply to support individual tasks, but to coordinate multiple intrusion activities simultaneously, potentially reducing the time defenders have to identify and contain an attack.
How Was AI Used in the Attacks?
ARTEX AI was originally developed as a penetration-testing framework designed to automate security assessments. However, researchers have now observed it being used to conduct offensive operations against real-world targets.
Rather than relying on a human operator to manually execute every stage of an intrusion, Vapor Panda reportedly deployed multiple AI agents capable of carrying out different activities concurrently.
These included identifying vulnerable systems, testing potential entry points, extracting credentials, scanning internal networks and identifying opportunities to escalate privileges.
The agents could also adapt when initial attempts failed, exploring alternative routes into targeted environments.
Human operators retained oversight of the campaign, but the automation allowed them to manage several intrusion attempts simultaneously.
This represents an important shift from AI-assisted hacking towards AI-coordinated attack operations, where much of the technical execution can be delegated to autonomous systems.
Attackers Deliberately Avoided Protected Systems
One particularly notable finding was the attackers’ awareness of endpoint security controls.
CrowdStrike researchers observed instructions directing AI agents to avoid Windows systems protected by CrowdStrike Falcon, instead prioritising hosts without that protection installed.
This demonstrates how AI-driven attacks can incorporate information about an organisation’s defensive posture into their decision-making.
Rather than repeatedly attempting to compromise well-protected systems, the agents could identify and pursue potentially easier targets.
For organisations, this reinforces the importance of consistent security coverage across the entire environment. A small number of unmanaged or unprotected systems may provide attackers with an alternative route into otherwise well-defended networks.
A Separate AI Attack Reached Root Access in 12 Minutes
The potential speed of autonomous attacks was further demonstrated in a separate incident involving the Dutch Institute for Vulnerability Disclosure (DIVD).
In September 2026, DIVD reportedly experienced an intrusion involving an autonomous ARTEX AI agent that exploited two previously unknown vulnerabilities in the Zammad application and underlying environment.
The agent progressed from initial access to root-level privileges in approximately 12 minutes.
During the attack, it reportedly generated more than 450,000 requests and executed approximately 2,500 scripts while conducting activities including internal network scanning, mailbox access and authentication-token extraction.
Although this was a separate incident from the Vapor Panda campaign, it demonstrates how AI agents can compress activities that might previously have required sustained manual effort into a matter of minutes.
However, the high volume of requests and scripts also created considerable noise, potentially providing defenders with opportunities to identify abnormal behaviour.
Why This Matters
The most significant concern is not necessarily that AI introduces entirely new attack techniques, but that it can make existing techniques faster, more scalable and easier to coordinate.
Password spraying, vulnerability exploitation, credential theft and privilege escalation are well-established tactics. What changes is the speed at which they can be executed and the number of targets that can be pursued simultaneously.
For security teams, this creates several challenges.
An attacker may move from initial access to elevated privileges before a traditional investigation has progressed beyond its first alert. Multiple suspicious activities may also occur concurrently, making it harder to reconstruct a conventional, sequential attack chain.
The campaign also demonstrates that attackers may deliberately exploit gaps in endpoint protection, legacy authentication systems and exposed applications rather than attempting to defeat an organisation’s strongest controls.
For UK organisations operating in strategically important sectors, including telecommunications, defence, manufacturing and financial services, these developments warrant particular attention.
Detection & Monitoring Recommendations
Defending against AI-enabled attacks does not necessarily require entirely new detection technologies. Many of the underlying behaviours remain recognisable, even when they are performed autonomously.
SOC teams should prioritise monitoring for:
Password spraying and unusual authentication patterns
Suspicious administrator-token creation or use
Unexpected access to privileged mailboxes
Rapid sequences of reconnaissance and privilege escalation
Web-shell deployment and abnormal web-server processes
High-volume scripting or automated network requests
Unusual internal scanning and lateral movement
Suspicious activity involving systems without endpoint protection
The key is to correlate these behaviours across identity, endpoint, network and application telemetry, rather than investigating each alert in isolation.
For example, repeated authentication failures followed by a successful privileged login, rapid internal scanning and unexpected script execution may collectively indicate an intrusion even if the individual events initially appear less significant.
Recommended Actions
Organisations should review whether their current security controls provide sufficient visibility and response capability to identify rapidly developing intrusions.
Particular priorities include:
Validate endpoint coverage: Identify unmanaged devices and systems without effective endpoint detection and response (EDR) protection.
Strengthen identity security: Review privileged accounts, authentication tokens and historical credentials that may remain accessible in configuration backups.
Prioritise exposed applications: Identify and remediate vulnerabilities affecting internet-facing services and authentication infrastructure.
Improve behavioural detection: Ensure monitoring can identify suspicious activity across multiple systems and attack stages.
Review response times: Assess whether existing investigation and containment processes can respond to compromises developing within minutes.
Security teams should also review their environments for indicators of compromise associated with the BLOODALCHEMY backdoor, which CrowdStrike identified during the VAPOR PANDA campaign.
Analyst Assessment
The reported Vapor Panda campaign represents a significant development in the use of AI for cyber-espionage.
Three aspects are particularly concerning: the scale of targeting across more than 200 organisations, the demonstrated ability of autonomous agents to progress through intrusion stages rapidly, and the deliberate avoidance of systems protected by endpoint security controls.
The separate DIVD incident, where an AI agent reportedly achieved root privileges within 12 minutes, further illustrates how quickly an automated intrusion can develop.
For defenders, the priority should not be to focus exclusively on identifying ARTEX AI itself. Instead, organisations should ensure they can detect and respond to theunderlying attacker behaviours, regardless of whether those actions are performed manually or by autonomous agents.
As AI-enabled offensive capabilities continue to develop, comprehensive security visibility, behavioural correlation and rapid response will become increasingly important.
How NormCyber MDR Helps Defend Against AI-Enabled Attacks
AI-enabled attacks may accelerate intrusion activity, but the behaviours they produce — including credential abuse, suspicious process execution, privilege escalation and lateral movement — remain detectable when the right security monitoring is in place.
NormCyber’s Managed Detection and Response (MDR) service provides continuous, 24/7 monitoring across supported endpoints, identities and network environments, helping organisations identify suspicious activity before it develops into a wider compromise.
Our SOC analysts correlate signals across multiple security technologies to identify patterns that might otherwise appear as isolated events, including unusual authentication activity, unexpected administrative behaviour and rapid sequences of potentially malicious actions.
By combining expert-led investigation with continuous monitoring and response, NormCyber MDR helps organisations strengthen their ability to detect and contain threats, even as attackers increasingly use AI to accelerate their operations.
