AI-Powered Cyberattacks: Chinese Hackers Use ARTEX Against 200+ Organisations

The China-linked hacking group VAPOR PANDA has used an AI-enabled framework called ARTEX to attack more than 200 organisations across at least 14 countries, according to Check Point Research. The campaign targeted government agencies, telecommunications providers, and defence companies, with confirmed intrusions involving credential theft and deployment of the BLOODALCHEMY backdoor.

This is one of the clearest examples yet of artificial intelligence being weaponised at scale for cyber espionage, marking a major escalation in AI-driven cyber threats.

What is ARTEX?

ARTEX is an AI-enabled cyberattack framework used by the VAPOR PANDA threat group. It leverages artificial intelligence to automate and enhance various stages of the attack lifecycle.

Key capabilities include:

• Automated reconnaissance

• Credential theft

• Malware deployment

• Lateral movement support

• Social engineering enhancement

• Attack workflow acceleration

Who is VAPOR PANDA?

VAPOR PANDA is a China-linked cyber espionage group tracked by Check Point Research. The group uses AI tools to support reconnaissance, develop malicious tools, refine social engineering, and accelerate intrusion workflows.

Group profile

Which organisations were targeted?

The campaign targeted more than 200 organisations across at least 14 countries, including:

• Government agencies

• Telecommunications providers

• Defence companies

Confirmed intrusions involved:

• Credential theft

• Deployment of the BLOODALCHEMY backdoor

The full list of affected organisations and countries has not been publicly disclosed, but the scale and targeting suggest a coordinated state-sponsored espionage operation.

What is BLOODALCHEMY?

BLOODALCHEMY is a backdoor malware deployed by VAPOR PANDA during confirmed intrusions. It gives attackers persistent access to compromised systems, allowing them to:

• Maintain long-term access

• Steal sensitive data

• Move laterally across networks

• Deploy additional tools

• Exfiltrate credentials and intellectual property

How AI is changing cyberattacks

The VAPOR PANDA campaign is part of a broader trend of AI adoption among cyber threat actors.

Other AI threat activity

Check Point Research also documented:

• GOLD OGRE ransomware group using AI agents during Aur0ra attacks to perform network reconnaissance, identify privileged accounts, and support lateral movement

• North Korean cyber threat actors expanding AI adoption to support reconnaissance, develop malicious tools, refine social engineering, and accelerate intrusion workflows.

What this means

AI is no longer just a defensive tool. Threat actors are using it to:

• Automate reconnaissance at scale

• Identify high-value targets faster

• Craft more convincing phishing and social engineering

• Develop and test evasion techniques

• Accelerate the full attack chain

Why this matters for businesses

The ARTEX campaign shows that AI-powered attacks are no longer theoretical—they are happening now at scale.

Key risks for organisations

• Government agencies: Risk of state-sponsored espionage and data theft

• Telecom providers: Risk of network compromise and customer data exposure

• Defence companies: Risk of intellectual property and classified data theft

• All businesses: Risk of AI-enhanced phishing, credential theft, and ransomware

Protective measures

• Implement zero-trust architecture

• Use multi-factor authentication everywhere

• Monitor for unusual AI-related network activity

• Train staff on AI-enhanced phishing

• Segment networks to limit lateral movement

• Keep endpoint detection and response (EDR) tools updated

• Audit third-party vendors and supply chains

• Have an AI-specific incident response plan

Comparison: AI threats in the wild

What happens next?

• Check Point and other researchers will continue tracking VAPOR PANDA and ARTEX

• More affected organisations may be identified

• AI security regulations may tighten globally

• Businesses are urged to review AI-related security posture

• The full extent of data stolen remains unknown

This is a developing story. Global IT Services will update this article as new verified information emerges.

Frequently Asked Questions

What is the ARTEX framework?

ARTEX is an AI-enabled cyberattack framework used by the China-linked VAPOR PANDA group to automate reconnaissance, credential theft, and malware deployment.

How many organisations were attacked?

More than 200 organisations across at least 14 countries were targeted in the campaign.

Which sectors were targeted?

Government agencies, telecommunications providers, and defence companies were the main targets.

What is BLOODALCHEMY?

BLOODALCHEMY is a backdoor malware deployed during confirmed intrusions, giving attackers persistent access to compromised systems.

Who is VAPOR PANDA?

VAPOR PANDA is a China-linked cyber espionage group tracked by Check Point Research, known for using AI tools in its operations.

How can businesses protect against AI-powered attacks?

Use zero-trust architecture, multi-factor authentication, network segmentation, staff training on AI-enhanced phishing, and AI-specific incident response plans.

Sources

• Check Point Research — 2 November 2026 Threat Intelligence Reportresearch.checkpoint

• Check Point Research — AI Threats and Global Campaigns

• ENISA — European Union Agency for Cybersecurity

• CISA — Cybersecurity and Infrastructure Security Agency