Thehackernews Chinese State Hackers Target 200+ Organizations Using AI-Powered ARTEX
Article Content
- •VAPOR PANDA targeted over 200 organizations using AI-powered ARTEX.
- •Successful intrusions confirmed at nine organizations, deploying BLOODALCHEMY malware.
- •The campaign represents a significant escalation in state-sponsored cyber operations.
CrowdStrike OverWatch reported a campaign by VAPOR PANDA, utilizing AI-powered ARTEX, targeting over 200 organizations globally since October 17, 2026. The campaign affected foreign ministries in Latin America, Europe, Asia, and the Middle East, as well as U.S. defense and telecommunications sectors. The adversary deployed the BLOODALCHEMY backdoor and conducted follow-on credential spraying and reconnaissance. The operation marks a significant escalation in state-sponsored cyber activities, with AI agents executing parallel attack paths under human direction. CrowdStrike confirmed post-exploitation activity at nine organizations, indicating successful intrusions. The campaign is distinct from other recent ARTEX activities, highlighting the evolving tactics of state-sponsored actors. The use of AI in this context raises concerns about the future of cybersecurity defenses.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (3)
Following this threat?
Track Vapor Panda and BloodAlchemy in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Which organizations are affected?
What malware was deployed?
How should organizations respond?
Continue Reading
Binance Hack: $6.3 Billion Stolen in Largest Crypto Heist On October 29, 2026, Binance, the world's largest cryptocurrency exchange, reported a major security incident involving an estimated $6.3 billion in stolen funds. The attack was attributed to a compromised laptop belonging to a DevOps engineer, allowing unauthorized withdrawal transactions. Approximately $3 billion in… 
China-Linked Hackers Exploit PHP2Shell Vulnerabilities to Breach U.S. Government Systems On October 21, 2026, the PHP development team released patches for two critical vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated remote code execution. These vulnerabilities were actively exploited by a suspected China-linked threat actor who compromised 25…