AI-Powered Cyberattacks: Chinese Hackers Use ARTEX Against 200+ Organisations

The China-linked hacking group VAPOR PANDA has used an AI-enabled framework called ARTEX to attack more than 200 organisations across at least 14 countries, according to Check Point Research. The campaign targeted government agencies, telecommunications providers, and defence companies, with confirmed intrusions involving credential theft and deployment of the BLOODALCHEMY backdoor.

This is one of the clearest examples yet of artificial intelligence being weaponised at scale for cyber espionage, marking a major escalation in AI-driven cyber threats.

What is ARTEX?

ARTEX is an AI-enabled cyberattack framework used by the VAPOR PANDA threat group. It leverages artificial intelligence to automate and enhance various stages of the attack lifecycle.

Key capabilities include:

Automated reconnaissance
Credential theft
Malware deployment
Lateral movement support
Social engineering enhancement
Attack workflow acceleration

Who is VAPOR PANDA?

VAPOR PANDA is a China-linked cyber espionage group tracked by Check Point Research. The group uses AI tools to support reconnaissance, develop malicious tools, refine social engineering, and accelerate intrusion workflows.

Group profile

Attribute	Details
Name	VAPOR PANDA
Attribution	China-linked
Main tool	ARTEX AI-enabled framework
Malware deployed	BLOODALCHEMY backdoor
Targets	Government, telecom, defense
Countries affected	At least 14
Organisations attacked	200+

Which organisations were targeted?

The campaign targeted more than 200 organisations across at least 14 countries, including:

Government agencies
Telecommunications providers
Defence companies

Confirmed intrusions involved:

Credential theft
Deployment of the BLOODALCHEMY backdoor

The full list of affected organisations and countries has not been publicly disclosed, but the scale and targeting suggest a coordinated state-sponsored espionage operation.

What is BLOODALCHEMY?

BLOODALCHEMY is a backdoor malware deployed by VAPOR PANDA during confirmed intrusions. It gives attackers persistent access to compromised systems, allowing them to:

Maintain long-term access
Steal sensitive data
Move laterally across networks
Deploy additional tools
Exfiltrate credentials and intellectual property

How AI is changing cyberattacks

The VAPOR PANDA campaign is part of a broader trend of AI adoption among cyber threat actors.

Other AI threat activity

Check Point Research also documented:

GOLD OGRE ransomware group using AI agents during Aur0ra attacks to perform network reconnaissance, identify privileged accounts, and support lateral movement
North Korean cyber threat actors expanding AI adoption to support reconnaissance, develop malicious tools, refine social engineering, and accelerate intrusion workflows.

What this means

AI is no longer just a defensive tool. Threat actors are using it to:

Automate reconnaissance at scale
Identify high-value targets faster
Craft more convincing phishing and social engineering
Develop and test evasion techniques
Accelerate the full attack chain

Why this matters for businesses

The ARTEX campaign shows that AI-powered attacks are no longer theoretical—they are happening now at scale.

Key risks for organisations

Government agencies: Risk of state-sponsored espionage and data theft
Telecom providers: Risk of network compromise and customer data exposure
Defence companies: Risk of intellectual property and classified data theft
All businesses: Risk of AI-enhanced phishing, credential theft, and ransomware

Protective measures

Implement zero-trust architecture
Use multi-factor authentication everywhere
Monitor for unusual AI-related network activity
Train staff on AI-enhanced phishing
Segment networks to limit lateral movement
Keep endpoint detection and response (EDR) tools updated
Audit third-party vendors and supply chains
Have an AI-specific incident response plan

Comparison: AI threats in the wild

Threat actor	AI use	Target	Impact
VAPOR PANDA	ARTEX framework	Government, telecom, defence (14 countries)	200+ orgs, credential theft, BLOODALCHEMY
GOLD OGRE	AI agents for recon and lateral movement	Various (Aur0ra attacks)	Ransomware deployment
North Korean actors	LLMs for recon, tool dev, social engineering	Various	Espionage and financial theft

What happens next?

Check Point and other researchers will continue tracking VAPOR PANDA and ARTEX
More affected organisations may be identified
AI security regulations may tighten globally
Businesses are urged to review AI-related security posture
The full extent of data stolen remains unknown

This is a developing story. Global IT Services will update this article as new verified information emerges.

Frequently Asked Questions

What is the ARTEX framework?

ARTEX is an AI-enabled cyberattack framework used by the China-linked VAPOR PANDA group to automate reconnaissance, credential theft, and malware deployment.

How many organisations were attacked?

More than 200 organisations across at least 14 countries were targeted in the campaign.

Which sectors were targeted?

Government agencies, telecommunications providers, and defence companies were the main targets.

What is BLOODALCHEMY?

BLOODALCHEMY is a backdoor malware deployed during confirmed intrusions, giving attackers persistent access to compromised systems.

Who is VAPOR PANDA?

VAPOR PANDA is a China-linked cyber espionage group tracked by Check Point Research, known for using AI tools in its operations.

How can businesses protect against AI-powered attacks?

Use zero-trust architecture, multi-factor authentication, network segmentation, staff training on AI-enhanced phishing, and AI-specific incident response plans.

AI-Powered Cyberattacks: Chinese Hackers Use ARTEX Against 200+ Organisations

What is ARTEX?

Who is VAPOR PANDA?

Group profile

Which organisations were targeted?

What is BLOODALCHEMY?

How AI is changing cyberattacks

Other AI threat activity

What this means

Why this matters for businesses

Key risks for organisations

Protective measures

Comparison: AI threats in the wild

What happens next?

Frequently Asked Questions

What is the ARTEX framework?

How many organisations were attacked?

Which sectors were targeted?

What is BLOODALCHEMY?

Who is VAPOR PANDA?

How can businesses protect against AI-powered attacks?

Sources

ai-cyberattacks

AI-Powered Cyberattacks: Chinese Hackers Use ARTEX Against 200+ Organisations