Inside ARTEX: How Three Threat Groups Turned One Agentic Framework Into a Production Line

Three threat actors, working independently and aimed at three different sectors, ran the same agentic AI framework within the same three-week window this fall. CrowdStrike identified a China-nexus actor it tracks as VAPOR PANDA using the framework, called ARTEX, against government, pharmaceutical, semiconductor and defense targets starting October 17, 2026, according to Industrial Cyber's November 5 report. Microsoft identified a Cambodia-based cluster, Storm-3358, running the same ARTEX framework against financial institutions starting in October 2026, in a report published November 7. Google Cloud's threat intelligence team and Mandiant, in an October 30 report, named ARTEX alongside two other open-source agentic frameworks, Hexstrike and CAIRN, as tools now weaponized across multiple campaigns.

No single one of those reports states the pattern this way. Put together, they show one toolchain adopted by separate operators and pointed at separate target lists inside one calendar month.

VAPOR PANDA's numbers, and one that doesn't reconcile

CrowdStrike told CyberScoop, in an October 30 report, that VAPOR PANDA compromised 140 sensitive targets across 14 countries in 11 days using an agentic AI-powered penetration testing tool, calling the campaign "remarkably successful" and operating at a speed the firm said was unachievable through manual methods. Industrial Cyber's November 5 account of the same actor describes a campaign against more than 200 organizations starting October 17, using ARTEX to coordinate "planner" and "worker" agents built on the DeepSeek LLM, automating reconnaissance, credential theft and lateral movement before deploying the BLOODALCHEMY backdoor. In one intrusion, the planning agents alone consumed roughly 1.4 billion input tokens, Industrial Cyber reported.

The two figures do not share a stated counting basis. The CyberScoop number describes 140 compromises in an 11-day window; the Industrial Cyber number describes more than 200 organizations in a campaign that had been running since October 17. Neither report says whether these are the same count under different labels, whether one supersedes the other, or whether "targets" and "organizations" mean different things in CrowdStrike's own tracking. CrowdStrike is the attributed source for both figures and has not reconciled them in either account.

Credentials are the fastest path

Microsoft, in a separate November 5 report, documented an AI agent that progressed from scanning GitHub repositories for exposed secrets to exfiltrating data from Azure Key Vault in five minutes, using compromised service principal credentials for rapid cloud resource discovery once the agent located valid secrets. Microsoft's recommended countermeasure is deliberately low-tech: honeypots and tarpits built to consume the agent's time and token budget, on the premise that an automated agent, unlike a human operator, will keep working a dead end until its budget runs out.

CrowdStrike Intelligence found the same constraint in a different case. Cybersecurity Dive reported on October 22 that a Spanish-speaking actor had used a dual-agent "Supervisor and Executor" architecture, derived from the open-source PentestGPT project, to target healthcare entities in Argentina, and that CrowdStrike identified token budgets, not engineering complexity, as the actor's binding constraint on scale.

The espionage precedent

Anthropic disclosed the pattern before any of the ARTEX reporting surfaced. The company said it had identified a sustained espionage operation, tracked as GTG-10007, in which Chinese-speaking operators used Claude to agentically conduct vulnerability research and exploit design, establishing what Anthropic called "automated exploit foundries" running around the clock. The same tooling, Anthropic said, was used to fingerprint email systems and build target lists for phishing at scale.

The access does not require skill

Not every case involves a state-nexus actor. Unit 42 at Palo Alto Networks reported on October 21 that it had investigated a threat actor's operational environment and found AI assistants being used to plan VoIP fraud and WordPress exploitation, with the attacker relying on AI-generated scripts and reconnaissance reports to execute activity Unit 42 said was beyond the operator's own skill level. The same class of tooling that is accelerating state operators is also putting complex intrusion chains in reach of low-skilled criminal actors.

"Black October" and the patching gap

The Guardian reported on October 23 that security leaders had begun calling October 2026 "Black October" following a surge in AI-driven attacks, including the discovery of critical PHP vulnerabilities, dubbed PHP2Shell, found using AI models. Anthropic's deputy CISO, Jason Clinton, told the Guardian the industry faces a "vulnerability tsunami," warning that AI now identifies flaws at a pace that makes traditional patching cadences unworkable. Cloudflare CEO Matthew Prince told the same outlet that new AI tools with "infinite patience" are now scanning the entire internet for vulnerabilities, continuously and without the fatigue that limits human reconnaissance teams.

A framework built for espionage, pointed at banks

The detail worth tracking is Storm-3358's pivot. GTG-10007 and VAPOR PANDA both targeted sectors with long patch-validation cycles — defense, pharmaceutical, semiconductor, government — the kind of environment where an espionage operator can expect tooling to keep working for weeks before detection forces a rebuild. Storm-3358 took the same ARTEX framework and ran it against financial institutions instead, automating exploitation of web application flaws such as SSRF and anonymous file uploads to install remote access tools including WISP and AdaptixC2, then abusing compromised cloud identities for exfiltration, Microsoft said. Nothing about ARTEX's architecture required that switch. An operator with the framework already running needed only a different target list and a different initial-access technique.

That portability, more than any single campaign's scale, is what security teams evaluating ARTEX exposure should weigh: a toolchain documented in defense and pharmaceutical environments in October was running against banks within the same month, with no retooling described in either account beyond the exploit set used for initial access.

Links Verified at Time of Publish.

Sources

This article was reported from the following sources.

1. VAPOR PANDA hackers use multi-agent AI to target government, pharmaceutical, semiconductor, defense organizations — Industrial Cyber, 2026-11-05
2. ARTEX abuse expands as cybercriminals target financial sector — Microsoft Security Blog, 2026-11-07
3. ARTEX and Friends: Enter Agentic Offensive Frameworks — Google Cloud Blog, 2026-10-30
4. 'Black October': cybersecurity experts sound the alarm over new era of AI-enabled hacking — The Guardian, 2026-10-23
5. Detecting and countering misuse of AI: September 2026 — Anthropic, 2026-09-01
6. China-backed threat group used agentic AI pentesting tool to compromise 140 sensitive targets in 11 days — CyberScoop, 2026-10-30
7. Agentic AI helps hackers level up, even without detailed instructions — Cybersecurity Dive, 2026-10-22
8. Threat actors use agentic AI tooling to find and abuse exposed secrets — Microsoft, 2026-11-05
9. “Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities — Unit 42 (Palo Alto Networks), 2026-10-21