On October 17, 2026, a single small operator team kicked off what may be the most telling real-world demonstration of agentic AI in state-sponsored cyber operations so far. Over the following eleven days, Vapor Panda, a China-nexus threat actor, ran the open-source ARTEX agentic AI framework, driven mainly by the Chinese-built DeepSeek large language model, against more than 200 organizations spread over at least 14 countries. By the time the campaign was publicly reported on October 29, at least nine victims had confirmed post-exploitation activity, and the operation was still running.

The techniques were not new. The speed and scale were.

This marks a structural change in how state-aligned espionage works, and it carries real consequences for every industrial organization that relies on the boundary between IT and OT. Below is the full breakdown.

The Campaign at a Glance

Investigators uncovered the operation through a single ARTEX controller tied to Vapor Panda infrastructure. That controller intermittently leaked the group's tooling, target lists and, most valuable of all, complete agent transcripts. The leak gives defenders a rare, almost first-person look at how an AI-driven intrusion campaign really runs.

One figure captures the degree of automation: in a single intrusion, the planning agents consumed roughly 1.4 billion input tokens, which suggests total usage across the whole campaign was far larger.

Who Is Vapor Panda, and Why Does This Expansion Matter?

Vapor Panda has been tracked since 2021, running patient espionage campaigns against government agencies, think tanks, and energy and extractive-industry organizations across Europe, North America, Oceania and the UK. Its mission has always been durable access and intelligence gathering.

Two things changed in October 2026:

• First use of AI-driven intrusion tooling. This is the first campaign in which the group has been seen deploying agentic AI.

• A sharp widening of targets. The group moved past its usual espionage profile into pharmaceutical, semiconductor, nuclear and defense organizations, plus telecom providers in the US, Belgium and the Philippines.

• The victim list looks deliberate. This was not opportunistic scanning that stumbled onto sensitive networks; it was a varied operational mission aimed at sectors and regions Beijing views as economically or politically important. The transcripts show the intent clearly:

• Foreign ministries of two Latin American countries were heavily penetrated, a third was likely compromised, and staged target files pointed to ministries in Central America and Asia.

• A Middle Eastern interior ministry was breached and BLOODALCHEMY was installed.

• One engagement homed in on a single European country: its foreign ministry, presidency and prime minister's office, along with defense, justice, finance and intelligence bodies.

• Nineteen US organizations in pharmaceuticals, semiconductors, defense, nuclear and finance were targeted.

• Telecom providers in the US, Belgium and the Philippines were also in scope.

• Researchers estimate that roughly 70% of the campaign's targets were either confirmed compromised or showed moderate-confidence signs of a successful intrusion.

Inside ARTEX: How an Autonomous Intrusion Framework Works

ARTEX is an open-source, multi-agent penetration-testing framework: a set of LLM-driven agents built in Go with a Next.js front end. It is designed to run an autonomous penetration test from reconnaissance through exploitation and all the way to data exfiltration, with very little human involvement. Agents continually add discovered assets, vulnerabilities and credentials to a shared graph, and that graph informs every later decision.

Based on the exposed transcripts, the operating model looks like this:

1. The operator gives a high-level order. Instructions were written in Chinese, labeled "human instruction" and stamped in China Standard Time. Examples include creating web shells, extracting domain administrator credentials, and checking endpoint sensor coverage.

2. The main agent breaks the order down. A main agent coordinates subordinate planner and worker agents that all share the same graph of facts, findings and goals. Each engagement is a "task," and Vapor Panda ran several in parallel.

3. Planner agents choose attack paths. They explore web applications, cloud services, container environments, Active Directory, mail and VPN infrastructure at the same time.

4. Worker agents execute. When one path failed, the agents switched to another on their own.

5. Humans step in only at key moments. Operators redirect agents, supply context, or steer around defenses.

The human-in-the-loop detail that matters

This was no "set and forget" operation. The recovered transcripts show an operator giving instructions in Chinese and stepping in at critical points. At one global pharmaceutical organization, the operator told the agents to "find Windows machines in the domain without Falcon," using red-team slang for a popular endpoint sensor, so that activity could be routed through unmonitored hosts.

The takeaway for defenders: agentic AI does not replace the attacker, it amplifies them. One small team, steering at machine speed, can now do what once demanded a large, coordinated intrusion crew.

The speed problem in numbers

Human-driven hands-on-keyboard activity, tracked for around 15 years, typically topped out at about 40 commands per hour. With ARTEX, that figure can climb past 1,500 commands per hour.

Requests against victims arrived as frequently as every 10 seconds. That is not a small gain in attacker throughput; it is a change of category. Detection, response and containment controls tuned for human-paced attacks, measured in minutes or hours, are now being asked to withstand operations measured in seconds.

Anatomy of the Attack: Three Intrusions, One Kill Chain

Analysis of agent behavior inside three victim environments shows ARTEX agents stringing together real, well-understood techniques, the kind any mature security program should already be defending against, but executing them autonomously, in parallel and with relentless iteration.

Intrusion 1: US pharmaceutical organization, cloud takeover via SAML and XXE

The agent paired an unsigned SAML assertion with an XML external entity (XXE) flaw to reach the cloud Instance Metadata Service. From there it obtained a role able to issue administrative commands to thousands of instances, then escalated to a full enterprise administrator account.

Why it matters: two configuration weaknesses, missing SAML signature validation and an exposed metadata service, handed an AI agent the keys to an entire cloud estate. No zero-days were needed.

Intrusion 2: second US pharmaceutical organization, web shells, containers and delegation abuse

The agent planted web shells, exploited an unauthenticated orchestration service to gain root in a production container environment, read Local Administrator Password Solution (LAPS) passwords, and abused resource-based constrained delegation to impersonate a privileged account.

Why it matters: the path ran from internet-facing services into production infrastructure and identity systems, the same trajectory that ends at the OT boundary in industrial companies.

Intrusion 3: Greek government entity, 2022 keys that were never rotated

The operator fed the agent a 2022 directory export from the organization's mail server. Authentication keys that had probably never been rotated since let the agent forge an administrator token and read mailboxes. VPN configurations pulled from a user's sent mail, plus a VPN client key linked to a May 2024 email leak, then opened the internal network.

Why it matters: stale credentials from years-old exposure became the doorway for a 2026 intrusion. If your key-rotation policy only covers recent incidents, treat this as your wake-up call.

Post-exploitation: BLOODALCHEMY

At confirmed victims, Vapor Panda installed BLOODALCHEMY, a backdoor first documented publicly in October 2023. The loader used a legitimate GameHook binary renamed to svchost.exe to decrypt and launch a payload stored in a file called graphics-hook_config.bin. Command-and-control infrastructure was tied to Vapor Panda and included nodes not previously associated with public ARTEX reporting.

Bigger Than One Group: ARTEX Is Going Mainstream

The Vapor Panda campaign is not an isolated event. Analysts assess that the framework is quickly gaining popularity among several China-nexus adversaries, and that pairing agentic frameworks with commercial LLMs will very likely continue over the next 12 months.

A separate ARTEX-driven operation surfaced in the same window. Storm-0940, a China-state-aligned actor active since 2021, used ARTEX to automate attacks across aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, semiconductor and other sectors. That included the ConnectWise supply-chain compromise, where ARTEX attempted sign-ins against more than 2,250 downstream tenants and pushed OAuth application abuse to machine speed. In one cross-tenant password-spray run, telemetry captured over 151,000 failed logons, peaking at 2,900 failures per minute.

The trend line is steep: around 45 agentic adversary attacks were observed in September 2026, then 126 in October, and the count is still climbing.

None of the underlying techniques are new. What is new is that a handful of operators can run dozens of parallel intrusions at machine speed. Defenses that were "good enough" against human-paced attackers are being stress-tested by adversaries that never sleep, never get bored and try every path at once.

The OT Question: Should Industrial Operators Worry?

First, an important clarification: there is no public evidence from this campaign that OT controllers or industrial control systems were compromised. The reporting covers IT networks, cloud environments and identity infrastructure.

Still, "no OT impact observed" does not mean "no OT risk." Look at the victim list: telecom, energy (the Storm-0940 campaign explicitly hit energy and chemicals), defense, nuclear, pharmaceuticals and semiconductor manufacturing. These are industries where IT and OT convergence runs deepest, and where the documented attack paths end close to operational boundaries.

The chain repeatedly followed the same trajectory:

Internet-facing services → cloud identity → privileged credentials → internal reconnaissance → lateral movement

In an industrial enterprise, that last step is exactly where an IT compromise turns into an OT incident. The mitigations below aim to break the chain before it reaches Level 3 and below.

Defense in Depth: Keeping Agentic Intrusions Out of Your OT Environment

1. Rotate every key, including those in old backups

The Greek government intrusion worked because keys from a 2022 directory export were still valid four years later. After any suspected data exposure, including historical backups, directory exports and mail-server archives, rotate signing keys, pre-authentication keys, service credentials and VPN certificates. Treat credential rotation as a response to exposure, not only to active intrusion.

2. Shrink the identity attack surface

Enforce SAML signature validation everywhere. An unsigned assertion should be a hard failure, not a warning.

• Require IMDSv2 on cloud instances and restrict access to the metadata service.

• Constrain cloud roles by limiting which instances any one role can command. The pharma compromise succeeded because a single role could command thousands.

• Audit resource-based constrained delegation and remove unnecessary delegation paths in Active Directory.

• Protect LAPS by vaulting and rotating local admin passwords and monitoring for unusual read access.

3. Hunt for ARTEX-specific markers

• Published indicators your SOC can deploy today:

• Command lines containing artx or artex strings

• Cloud roles prefixed with artx

• art18- comments on administrative commands

• The directory C:\ProgramData\artx5v\

• BLOODALCHEMY indicators: graphics-hook-filter64.dll, graphics-hook_config.bin, renamed GameHook binaries, and the associated C2 infrastructure

Run these against endpoint telemetry, cloud audit logs and DNS/proxy records.

4. Segment IT from OT, and mean it

This is where industrial organizations hold a structural advantage, provided they enforce it:

• Use unidirectional or tightly brokered data flows between IT and OT zones. An agent landing on an IT workstation should hit a hard wall at the DMZ, not a routable path to a historian.

• Microsegment inside OT where feasible. Cell and area zones should not talk freely to one another; flat OT networks turn one compromised engineering workstation into a plant-wide incident.

• Lock down remote access. The VPN-config harvesting in this campaign shows how remote-access artifacts fuel lateral movement. Require MFA, dedicated jump hosts and session recording for all OT remote access.

• Deploy passive OT monitoring to baseline industrial protocol traffic. Agentic reconnaissance that is invisible to IT EDR, such as scanning proprietary industrial ports or enumerating controllers, stands out sharply against a passive baseline.

5. Assume machine-speed attacks and pre-stage machine-speed response

• Detection that pages an analyst, who opens a ticket, which waits in a queue, is too slow. Prioritize:

• Automated containment: EDR isolation, identity disablement and cloud credential revocation triggered by high-confidence detections, without human approval gates.

• Full EDR coverage, including "unreachable" servers. The agents explicitly hunted for machines without sensors, so any host that cannot run an agent belongs behind compensating network controls.

• Rate-based alerting. Password spraying and exploit bursts at machine cadence, thousands of failures per minute, are high-fidelity signals on their own.

• Aggressive patching of internet-facing appliances, especially long-lived Linux-based systems, a favored initial-access vector in both this campaign and the Storm-0940 activity.

What CISOs Should Take Away

• The attacker's economics have changed. Cost per target is collapsing. Campaigns that once demanded nation-state resources can now be run by small teams using open-source tooling and commercial LLM subscriptions.

• Old credentials are a live attack surface. Four-year-old keys from an old mail export opened a government network. Audit and rotate legacy credentials as a standing program, not just during incident response.

• Configuration hygiene is now AI-speed defense. SAML validation, IMDSv2, role scoping and delegation auditing are no longer checkbox items. They decide whether an agent hits a dead end or an enterprise admin account.

• OT segmentation is the last line, and it must be verified, not assumed. Every documented attack chain stopped one step short of operational technology. Industrial organizations that test and enforce their IT/OT boundaries, with passive monitoring to prove it, turn a potentially catastrophic scenario into a contained IT incident.

• This is the new baseline. Agentic frameworks are expected to spread across China-nexus actors and beyond, and reports of other state-linked groups, including North Korean ones, adopting ARTEX confirm that agentic AI intrusion is becoming standard tradecraft.

Frequently Asked Questions

What is the ARTEX AI cyberattack?

ARTEX is an open-source, multi-agent AI penetration-testing framework that the China-nexus actor Vapor Panda weaponized in an espionage campaign beginning October 17, 2026, targeting 200+ organizations in 14 countries. The agents autonomously handled reconnaissance, exploitation, credential theft and lateral movement, guided by human operators issuing instructions in Chinese.

Was Vapor Panda the same as Storm-0940?

No. Analysts assess these as distinct operations with separate infrastructure and tradecraft, which indicates ARTEX is being adopted by multiple China-nexus adversaries. The ConnectWise supply-chain compromise is attributed to Storm-0940.

Were OT systems compromised in this campaign?

No public evidence shows OT controllers or industrial control systems were compromised. However, targets included telecom, energy, defense, nuclear, pharmaceutical and semiconductor organizations, sectors where IT-to-OT lateral movement is the main OT risk scenario.

How do I detect ARTEX activity in my environment?

Hunt for artx/artex strings in command lines, artx-prefixed cloud roles, art18- comments on admin commands, the C:\ProgramData\artx5v\ directory, and BLOODALCHEMY artifacts (renamed GameHook binaries, graphics-hook-filter64.dll and graphics-hook_config.bin).

The Bottom Line

Vapor Panda's ARTEX campaign did not invent new attack techniques. It removed the two constraints that have always limited state-backed intrusion operations: people and time. One operator team, eleven days, 200 targets, with agents chaining SAML misconfigurations, XXE flaws, stale credentials and unauthenticated orchestration services into full enterprise takeovers.

The defensive fundamentals that stop this campaign are the ones security leaders have preached for a decade: rotate credentials, validate signatures, scope privileges, patch exposure, instrument everything and segment ruthlessly. What has changed is the price of getting them wrong. In an agentic AI threat landscape, a configuration gap is not an audit finding; it is an open door that an AI agent will find, exploit and pivot through in the time it takes a SOC analyst to finish a coffee.

Organizations that verify, rather than assume, their IT/OT segmentation, identity hygiene and automated containment will weather this shift. Those that do not should treat October 2026 as their warning shot.