A state-backed group tied to China has been running an automated penetration-testing framework called ARTEX against government, defense and industrial targets at a tempo that human operators cannot match.
CrowdStrike, which tracks the group as Vapor Panda, says the campaign began October 17 and has touched more than 200 organizations across at least 14 countries. Roughly 140 are confirmed compromised or show signs consistent with a successful intrusion.
The victim list reads like a targeting brief rather than an opportunistic sweep: foreign ministries, a European presidency and prime minister’s office, defense and intelligence agencies, nineteen U.S. organizations across pharma, semiconductors, defense, nuclear and finance, and telecom carriers in the U.S., Belgium and the Philippines.
Speed is the headline. Adam Meyers, who leads counter-adversary operations at CrowdStrike, said hands-on-keyboard work used to top out near 40 commands an hour. With the framework in place, activity has passed 1,500 an hour, with requests arriving as often as every ten seconds and multiple paths pursued at once.
ARTEX runs alongside DeepSeek models in the group’s stack. CrowdStrike describes the intrusion set as separate from the ARTEX activity Microsoft attributed to Storm-0940 this month, which included a supply-chain attack on ConnectWise customers.
The broader trend line is uncomfortable. CrowdStrike logged roughly 45 agentic adversary attacks in September and counted 126 in October, which is close to a threefold monthly climb.
Meyers argues the techniques themselves are not novel and the answer is visibility across endpoints, identities and network boundaries, since automated tooling still has to reach something to be useful.
For defenders, the practical implication is that detection tuned to the pace of a patient human intruder may simply see nothing. Campaigns that used to unfold over weeks now resolve in days, and triage queues built for slow adversaries will fall behind.
