Two Chinese-linked groups use ARTEX tool for cyberattacks
In brief
- VAPOR PANDA, a China-linked group, has used ARTEX since October 17 to target 200+ organizations in 14 countries.
- AI agents identify unprotected machines and exploit old flaws or data leaks to gain access.
- CrowdStrike advises changing keys after leaks, validating SAML signatures, and enforcing IMDSv2.
CrowdStrike reports that VAPOR PANDA, a China-linked espionage group, has used the open-source ARTEX tool since October 17 to target over 200 organizations across 14 countries. Nine confirmed intrusions were recorded, with a backdoor installed in several cases. Attackers deployed AI agents to identify machines unprotected by CrowdStrike's Falcon security software.
ARTEX coordinates planning and execution agents, enabling multiple parallel intrusions. Targets included European ministries, U.S. companies in pharmaceuticals, semiconductors, defense, and telecom operators. Agents exploited old flaws, such as authentication keys unchanged since 2022 or data leaks from 2024. CrowdStrike notes these tools, combining open-source and commercial subscriptions, reduce dependency on model providers.
CrowdStrike expects similar tools to be increasingly adopted by China-linked groups over the next twelve months. The report mentions target files prepared for ministries in Central America and Asia, though their use remains unconfirmed. The vendor recommends changing keys after any leak, validating SAML signatures, and enforcing IMDSv2.
What it changes for you
- CybersecuritySecurity vendors must enhance detection of open-source tools like ARTEX and adapt their recommendations to automated attacks.
- Public SectorGovernments must check for outdated authentication keys and harden cloud access controls.
- HealthPharmaceutical labs must monitor intrusions via agents exploiting unsigned XML or SAML flaws.
This summary gives you the essentials. The full article, its figures and quotes are on ActuIA.
Read the original articleAI-generated summary of the source, checked by rules. How we write · Report an error