CrowdStrike says China-linked hackers used ARTEX to target more than 200 organizations

Microsoft separately linked the AI framework to another China-state-aligned group, while CrowdStrike's findings showed human operators directing intrusion tasks.

        By [Emerson Redding](https://runtimewire.com/author/emerson-redding)
        · Published 
        · Updated 

Primary source: [crowdstrike.com](https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign)

Why it matters #

CrowdStrike and Microsoft describe separate China-linked groups using the same AI framework for intrusion work. Their findings illustrate how attackers are applying language models to operational tasks. Copies of ARTEX remain freely available on GitHub.

Corrections #

• 2026-10-30: Update: Updated Oct. 30 with RuntimeWire's check of ARTEX copies on GitHub. China-nexus hacking group VAPOR PANDA used the open-source AI framework ARTEX to target more than 200 organizations worldwide, Kirsten Speas, CrowdStrike's director of public relations for counter adversary operations, said in an email to RuntimeWire.…

When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.