Google Threat Intelligence Group (GTIG) and Mandiant reported observing multiple threat actors abusing ARTEX and other offensive frameworks in incident-response investigations since late August 2026. Their findings broaden the picture beyond CrowdStrike’s separate attribution of a campaign to VAPOR PANDA: the wider observations involve multiple actors, not one named operation. GTIG and Mandiant’s report was published October 30.
What the broader ARTEX finding covers
GTIG and Mandiant described activity by financially motivated actors and suspected espionage clusters across several stages of the attack lifecycle. Their account adds a framework-specific thread to NeoTeo’s earlier coverage of four groups that used AI agents in cyberattacks.
The observation window began in late August 2026, before CrowdStrike’s report on VAPOR PANDA. The wider finding does not attribute every ARTEX case to that group.
CrowdStrike’s separate VAPOR PANDA campaign
CrowdStrike attributed a campaign that began October 17, 2026, and lasted 11 days to VAPOR PANDA, which the company assesses as China-linked. The campaign account reports more than 200 organizations targeted across at least 14 countries, with post-entry activity confirmed at nine organizations. Those figures describe targets and confirmed post-entry activity, respectively. CrowdStrike’s campaign report also identifies ARTEX and DeepSeek in the operation.
ARTEX, DeepSeek and the human operator
ARTEX is a penetration-testing framework that coordinates tools and agents backed by language models. It is not itself an AI model. In the VAPOR PANDA campaign, DeepSeek was reportedly the primary model behind ARTEX, alongside an unidentified commercial model.
The campaign account describes a human operator issuing instructions in Chinese while ARTEX’s planner and worker agents handled tasks. DeepSeek’s reported role was as a model used through the framework; the operator directed the campaign.
