China-linked hackers unleashed AI agents on 200 organizations — nine fell

CrowdStrike researchers say a China-nexus operator tracked as Vapor Panda used ARTEX, an open-source multi-agent penetration-testing framework, in attacks against more than 200 organizations across 14 countries starting October 17, targeting government ministries, telecom providers, and pharmaceutical, semiconductor, defense, nuclear and financial firms.

At least nine organizations were compromised and at least 12 more high-value targets faced password spraying and credential scanning; in the Greek government intrusion, the agents forged an administrator token and read mailboxes using authentication keys from a 2022 mail-server directory export.

In one intrusion the agents burned through more than 1.4 billion input tokens, and a separate Dutch disclosure says an ARTEX agent went from initial access to root privileges in 12 minutes — CrowdStrike calls it an escalation from single intrusions to multiple simultaneous engagements directed by a human operator.