CrowdStrike: China-supported threat group used agentic AI penetration testing tool to compromise about 140 sensitive targets in 11 days

CrowdStrike released a threat report on Thursday stating that a China-supported threat group codenamed Vapor Panda used the automated agentic AI penetration testing framework ARTEX together with DeepSeek to compromise about 140 sensitive targets in 11 days. Since October 17, the group has attacked more than 200 organizations in at least 14 countries, with victims including multiple foreign ministries, the presidential office and prime minister's office of one European country, defense and intelligence agencies, 19 U.S. pharmaceutical, semiconductor, defense, nuclear and financial institutions, and U.S., Belgian and Philippine telecom operators; about 70% of targets were confirmed compromised or had medium-confidence evidence of successful intrusion. The report said ARTEX made requests at a peak rate of once every 10 seconds and could pursue multiple attack paths in parallel, raising operational speed from at most 40 commands per hour in manual intrusion to more than 1500. CrowdStrike executive Adam Meyers said this is the first time an agentic nation-state threat actor has been seen at this scale, and that such malicious attacks rose from about 45 in September to 126 in October.