CrowdStrike says China-linked hackers used ARTEX to target more than 200 organizations

China-nexus hacking group VAPOR PANDA used the open-source AI framework ARTEX to target more than 200 organizations worldwide, according to CrowdStrike, whose director of public relations for counter adversary operations, Kirsten Speas, confirmed the figure in an email to RuntimeWire. Microsoft separately linked the AI framework to another China-state-aligned group, and CrowdStrike's findings showed human operators directing intrusion tasks. Copies of ARTEX remain freely available on GitHub.

CrowdStrike says China-linked hackers used ARTEX to target more than 200 organizations Microsoft separately linked the AI framework to another China-state-aligned group, while CrowdStrike's findings showed human operators directing intrusion tasks. By Emerson Redding https://runtimewire.com/author/emerson-redding · Published · Updated Primary source: crowdstrike.com https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign Why it matters CrowdStrike and Microsoft describe separate China-linked groups using the same AI framework for intrusion work. Their findings illustrate how attackers are applying language models to operational tasks. Copies of ARTEX remain freely available on GitHub. Corrections - 2026-10-30: Update: Updated Oct. 30 with RuntimeWire's check of ARTEX copies on GitHub. China-nexus hacking group VAPOR PANDA used the open-source AI framework ARTEX to target more than 200 organizations worldwide, Kirsten Speas, CrowdStrike's director of public relations for counter adversary operations, said in an email to RuntimeWire.… When you purchase through links in our articles, we may earn a small commission https://runtimewire.com/affiliate-monetization-standards . This doesn’t affect our editorial independence.