An AI Agent Went From First Access to Root in 12 Minutes. A China-Linked Group Is Using the Same Framework Against 200 Organizations. Would Your SOC Notice a Break-In That Loud?

CrowdStrike says a China-nexus group it tracks as Vapor Panda has used an open-source AI penetration-testing framework called ARTEX to run intrusions against more than 200 organizations in 14 countries since 17 October 2026. According to BleepingComputer's report, published 2 November, at least nine organizations were compromised and at least 12 other high-value targets faced password spraying and credential scanning. Targets span government ministries, telecom providers, and the pharmaceutical, semiconductor, defense, nuclear and financial sectors.

What the agents did

Per the same report, Vapor Panda used DeepSeek and a second, unidentified commercial LLM to drive planning agents and worker agents across several intrusions at once. Human operators gave instructions in Chinese and stepped in at critical decision points. The agents handled the routine work: reconnaissance, exploiting vulnerabilities, deploying web shells, stealing credentials, and switching to another attack path when one was blocked. In one intrusion the agents reportedly consumed more than 1.4 billion input tokens.

Two details stand out:

• Selective targeting. Operators reportedly told the agents to skip Windows machines protected by CrowdStrike Falcon and concentrate on hosts without that protection. The agent does not need to be stealthy if it can simply choose the unwatched machines.
• Old data, new use. In a Greek government case, the agents forged an administrator token and read mailboxes using authentication keys from a 2022 mail-server directory export. Material that looked like a stale leftover became the way in.

CrowdStrike also found the BLOODALCHEMY backdoor, active since 2023, used against government entities in Latin America and the Middle East. ARTEX's developers later made the framework proprietary after it was used in real attacks, including a campaign against South Korean financial institutions.

The 12-minute intrusion

The most useful data point comes from the Dutch Institute for Vulnerability Disclosure (DIVD), which was itself breached in September 2026. DIVD attributed the attack to an AI agent and later identified the tool as ARTEX AI. Reported figures:

• 12 minutes from initial access to root, by chaining a Zammad zero-day with a second zero-day for local privilege escalation.
• Parallel work: reading a compromised mailbox, scanning the internal network, extracting login tokens and attempting password resets at the same time.
• Over 450,000 requests and 2,500 scripts logged, which DIVD described as "super loud and messy."

That last point matters for defenders. The agent was fast but not quiet. A human operator working by hand rarely produces hundreds of thousands of requests in a single intrusion; an agent that retries, branches and tries alternatives does. The same behaviour that makes it quick also makes it visible, if someone is looking at the right telemetry in the right window.

What to change

The report does not publish detection guidance or indicators, so treat these as inferences from the described behaviour rather than vendor advice:

1. Alert on volume and breadth, not just known signatures. Hundreds of thousands of requests, thousands of short-lived scripts, and simultaneous mailbox, network and token activity from one source are anomalies even when each individual step looks routine.
2. Close the unprotected-host gap. If an attacker is steered toward hosts without endpoint protection, every unmonitored server, appliance and forgotten VM is the preferred route. Coverage gaps are now a targeting criterion.
3. Retire old credential material. Authentication keys and directory exports from years ago should be rotated or destroyed. The Greek case shows that a 2022 artifact was still usable.
4. Shorten your response clock. If first access to root can take 12 minutes, a triage queue measured in hours is not a control. Decide in advance which signals trigger automatic containment.

How Obiguard SOC fits

The ARTEX cases describe an attacker that moves at machine speed and generates a lot of events while doing it. Obiguard SOC is built for that mismatch: it ingests endpoint, identity and network telemetry in one place, correlates a burst of requests, token use and privilege changes into a single incident rather than thousands of separate alerts, and surfaces it while the intrusion is still in progress. It also reports which monitored assets are not sending telemetry, so the unprotected hosts an agent would be told to prefer show up as a gap on your side first. SOC cannot stop an unpatched zero-day from being exploited; what it shortens is the time between the first anomalous burst and a human or automated response. For the earlier stages of a similar chain, see our analysis of the PHP2Shell firewall pivot.

Sources

• BleepingComputer: Chinese hackers use ARTEX AI in automated attacks against 200 orgs