AI-powered hacking goes global as Chinese groups use ARTEX to automate cyber espionage

Chinese-linked hacking groups expanded attacks using ARTEX, an AI-driven penetration-testing tool whose planner and worker agents scan systems, exploit vulnerabilities and navigate networks while humans make final decisions. CrowdStrike reported Vapor Panda used ARTEX from Oct. 17, 2026, against more than 200 organizations in at least 14 countries, with confirmed post-exploitation at nine companies. Microsoft linked Storm-0940 to ARTEX from September 2026 and to the ConnectWise Cloud Backup compromise, tracking over 151,000 failed logins against 327 accounts at eight companies. Zscaler said a separate late-September 2026 campaign against South Korean financial institutions stole data on about 67,000 people and assessed the attacker as Chinese-speaking and financially motivated, without confirming state sponsorship.