CrowdStrike has identified a China-based "targeted intrusion adversary" it tracks as Vapor Panda (previously VexatiousTemper) using a Go-based, AI-powered penetration testing framework called ARTEX in a broad simultaneous campaign. Starting 17 October 2026, the tool was used against more than 200 distinct organisations worldwide, including foreign ministries in Latin America, Europe, Asia and the Middle East; US semiconductor, defence and think-tank targets; and telecommunications providers across multiple regions. The grouping overlaps with Trend Micro's Earth Estries cluster. CrowdStrike argues "agentic tooling like ARTEX enables this scale of expansion at speed, allowing a small team to pursue a wider target set than manual operations would support", rather than marking a wholesale shift away from the adversary's access-development mission. The scale of the target set — more than 200 organisations inside a fortnight — marks one of the broadest documented uses of an AI-driven framework in state-sponsored intrusion activity to date.

• Source article