CADChain Blog
2026-11-03 13:20 News

AI Cyber Espionage: China-Linked Hackers Used the ARTEX AI Agent Framework Against 200+ Organisations, Including Semiconductor and Defence Targets | CADChain | CAD DRM & IP

On 29 October 2026, CrowdStrike reported that the China-linked espionage group it calls VAPOR PANDA had used an AI agent hacking framework named ARTEX against more than 200 organisations in at least 14 countries, in just 11 days from 17 October. Targets included US semiconductor, defence, nuclear and pharmaceutical organisations. One day later, Google's threat intelligence group and Mandiant reported that several groups have used ARTEX since late August 2026, including against industrial automation and semiconductor manufacturing and design companies in the US and Europe.
ARTEX is not an AI model. It is an open-source framework that wraps hacking tools around large language models and splits an intrusion into tasks for several AI agents: one plans, others scan, test passwords, move through the network and report back. A human gives the orders. The agents do the typing, at a speed no human team can match. Google's researchers counted 27 events in 23 seconds in one operation, and saw one group get from a first stolen account to deep access in about four hours, in one case in 15 minutes.
For engineering companies, the important part is not the AI label. The attackers still used old weaknesses: stolen and unrotated keys, leaked VPN files, exposed admin services and weak passwords. What changed is how fast and how widely they can now use them. Below: what CrowdStrike and Google found, who was targeted, why design data is exposed, what defenders should change, and what to do this month.
TL;DR: AI agents now run espionage intrusions at machine speed

CrowdStrike says VAPOR PANDA used the ARTEX agent framework, mainly with the DeepSeek model, against more than 200 organisations in 11 days and confirmed hands-on activity at nine of them. Google and Mandiant say ARTEX has been used since late August 2026 by espionage and extortion groups, including against industrial automation and semiconductor design firms. The techniques are familiar: stolen credentials, unpatched systems, exposed admin interfaces. The speed is new. Lesson: rotate old keys, cut exposed admin access, watch for bursts of activity, and protect design files so a copy taken in minutes cannot be opened.

What did CrowdStrike find?

In a report published on 29 October 2026, CrowdStrike's Counter Adversary Operations team described the first time it saw VAPOR PANDA use AI-driven intrusion tools. Since 2021 the group had mainly targeted governments, think tanks, energy and extractive companies; with ARTEX it widened its reach and its sectors:
  • Scale: more than 200 distinct organisations in at least 14 countries over an 11-day window that began on 17 October 2026.
  • Confirmed intrusions: post-exploitation activity at nine organisations, where the attackers installed a backdoor known as BLOODALCHEMY, sprayed passwords, scanned networks and mapped systems. At least 12 more organisations saw password spraying and credential scanning.
  • Sectors: 19 US organisations in the pharmaceutical, semiconductor, defence, nuclear and financial sectors, telecom providers in the US, Belgium and the Philippines, and foreign ministries and government bodies in Latin America, Europe, Asia and the Middle East.
  • AI models: mainly DeepSeek, plus a second commercial model CrowdStrike could not confirm. The planning agents in a single intrusion used on the order of 1.4 billion input tokens.
  • The human: one operator issued instructions in Chinese and ran several engagements in parallel from one controller.
The way in was not exotic. CrowdStrike lists unsigned SAML login assertions combined with an XML flaw to reach a cloud metadata service, an unauthenticated orchestration service in a container environment, stolen VPN configuration files, a VPN client key the operator said came from a May 2024 email leak, and a 2022 mail server directory export with keys that had likely never been rotated. With those keys the agents forged an admin token and read mailboxes; at one pharmaceutical company they gained a cloud role that could command thousands of servers.
CrowdStrike did not say what data, if any, left the nine victims. It did say where this is heading: “China-nexus adversaries will highly likely continue adopting agentic frameworks such as ARTEX over the next 12 months.”

What is ARTEX, and who else uses it?

Google Threat Intelligence Group and Mandiant published their own analysis on 30 October. They describe ARTEX as an autonomous, multi-agent offensive platform written in Go, with a web console and six specialised sub-agents that can call commercial and open-source AI models. It was released on GitHub by a user called Autumn-27, who took the original repository down in October 2026 because of widespread abuse. Copies live on in forks, including a localised version and a commercial edition called ARTEX PRO.
According to Google, groups have used ARTEX in real intrusions since late August 2026, both financially motivated extortion crews and suspected espionage operators. One cluster, which overlaps with the group Microsoft tracks as Storm-0940, targeted enterprise software, industrial automation, semiconductor manufacturing and design, and telecom companies in the US and Europe. Microsoft has linked Storm-0940 to the compromise of ConnectWise Cloud Backup; our sister site covered how that backup tool became an attack path into Microsoft 365 tenants. Other clusters hit government, technology, chemicals and materials, and manufacturing organisations in the US. Google also saw a different agent framework, PentAGI, used with proxy services against the aerospace sector.
What the agents did inside networks reads like a checklist of an experienced intruder, compressed into minutes: they listed more than 110,000 Active Directory objects in one network, stole password hashes, created admin accounts within minutes, wrote web shells through a database and retried until they worked, and created a 100 GB storage volume, a typical step before copying data out. Google's summary is blunt: “LLM-enabled offensive tooling does not fundamentally change the techniques attackers use. It reduces the time required to combine them.”

Why should engineering companies care?

Semiconductor design, industrial automation, defence, aerospace and manufacturing are exactly the sectors named in these reports, and their most valuable assets are design data: CAD models, drawings, layouts, simulation files and process know-how. State-backed espionage has gone after these files for years; our article on industrial espionage and CAD theft tactics describes the classic methods. Last week we covered how APT28 went after a NATO naval shipbuilder and an aircraft engine maker, and in October how China-linked hackers for hire target CAD and PLM data.
Agent frameworks change the economics. One operator with ARTEX can probe hundreds of organisations at once and spend human attention only on the ones that open up. Mid-sized suppliers and deep-tech start-ups with valuable designs but small IT teams are now worth trying. And because the agents work in seconds, the window between a first login and a copied project folder shrinks to the length of a coffee break.
There is one piece of good news. Google notes that ARTEX currently trades stealth for speed: it leaves its own name in file and account names, generates hundreds of log entries through trial and error, and produces bursts of activity that look nothing like a human admin. Our article on AI-powered CAD file anomaly detection explains how unusual access patterns on design files can be flagged.
Attack stepWhat the AI agents didWhat slows it down
Getting inUsed stolen VPN files, leaked keys, unsigned SAML logins and exposed admin servicesRotate old keys, enforce SAML signature checks, keep admin interfaces off the internet
Taking controlForged admin tokens, read LAPS passwords, created admin accounts within minutesShort-lived credentials, MFA for all admin access, alerts on new admin accounts
Mapping the networkListed more than 110,000 directory objects and scanned for unprotected machinesNetwork segmentation, endpoint detection on every server, alerts on bursts of queries
Reaching dataRead mailboxes with a forged admin token and harvested cloud storage keysPer-project access to PDM and file shares, separate admin accounts, scoped storage keys
Copying data outCreated a 100 GB volume and used webhook services for command trafficEgress controls, alerts on bulk reads, file-level encryption so copies stay unreadable
Make a copied CAD file worthless. CADChain encrypts CAD files at file level and applies per-file permissions that travel with the file, so a model copied from a file server, PDM vault or laptop cannot be opened by people you did not authorise, however fast it was taken.

👉 See how CADChain protects CAD files

What do CrowdStrike and Google tell defenders to do?

CrowdStrike published indicators and ARTEX markers to hunt for, but Google warns that static indicators will not cover much of this activity, because the agents generate new scripts, accounts and paths as they go. The advice in both reports focuses on removing the easy wins and watching behaviour:
  • Rotate keys that live in old places. CrowdStrike tells defenders to rotate signing keys, pre-authentication keys and service credentials after any suspected exposure, including keys sitting in historical backups and directory exports.
  • Protect the control plane. Google advises restricting admin APIs, consoles and CI/CD pipelines to trusted networks, and treating publishing endpoints as privileged infrastructure.
  • Replace long-lived secrets. Use short-lived, tightly scoped credentials for workloads and cloud roles, enforce SAML signature validation and require the newer cloud metadata service version.
  • Harden the basics. Patch internet-facing appliances, limit database privileges that allow command execution, reduce NTLM and enforce SMB and LDAP signing.
  • Put guardrails on high-impact actions. Rate limits on account creation, credential retrieval and mass email, and an inventory of who can do what before an incident.
  • Watch for speed and volume. Bursts of management API calls, password resets, new accounts and bulk reads are the signature of an agent at work.
None of this is new advice; the difference is the deadline. Our report on Oracle Agile PLM vulnerabilities shows how engineering systems are often among the slowest to be patched.

What does this mean for European companies?

Europe is in these reports too: CrowdStrike lists a Greek government entity, a Belgian telecom provider and a European foreign ministry, and Google says the Storm-0940-linked cluster targeted companies in Europe as well as the US. European semiconductor, automation and defence suppliers should assume they are on the same target lists.
The legal side has not changed, but the stakes have. Under the EU Trade Secrets Directive, design data stays a trade secret only if the owner took reasonable steps to keep it secret, so access limits, encryption and logs matter in any later dispute. Our guide to trade secrets for deep-tech startups explains the tests, and audit trail requirements for IP litigation covers the records that hold up in court. Many manufacturers also have incident reporting duties under NIS2 and, for products with digital elements, the Cyber Resilience Act; yesterday's article on ransomware gangs targeting design data summarises the 24-hour and 72-hour clocks.

What should engineering companies do now?

  1. Hunt for old keys and leaked files. Search backups, directory exports, old VPN profiles and shared drives for credentials and keys, and rotate anything that could have been exposed in past incidents.
  2. Take admin interfaces off the internet. PDM, PLM, licence servers, VPN appliances, container orchestration and cloud consoles should only be reachable from trusted networks with MFA.
  3. Patch internet-facing systems first. Agents scan everything; the oldest unpatched appliance is the one they find.
  4. Limit access per project. An engineer, a service account or an AI tool should reach only the designs it needs, so one stolen account cannot open every project. Our guide to zero trust for CAD file distribution shows how.
  5. Alert on bursts, not only on signatures. Hundreds of directory queries, new admin accounts or bulk reads of design folders within minutes should page someone at any hour.
  6. Encrypt design files at file level. Disk and server encryption stop working once an attacker logs in as a user. File-level encryption keeps a copied model unreadable. See our comparison of file-level DRM and folder-level security and our guide to CAD encryption at rest, in transit and in use.
  7. Prepare the response, not only the detection. Decide in advance who can isolate a server, disable accounts and cut network links at night, because an agent will not wait for the morning meeting.
  8. Keep dated proof of your designs. Timestamped records of what you created and when help in disputes after a leak and show reasonable steps. Our complete guide to CAD file security covers the rest.

How does this fit the bigger picture?

Our sister sites covered other ways design data and creative work are copied, valued and protected this week.

Conclusion

The ARTEX reports mark a shift in pace rather than method. The attackers behind these campaigns used stolen keys, leaked VPN files and exposed admin services, the same weaknesses defenders have known for years. AI agents let one operator try them against hundreds of organisations at once, and move from first access to admin rights in hours or minutes.
For semiconductor, automation, defence and manufacturing companies, the answer is to remove the easy wins now, watch for machine-speed behaviour, and assume that some attacks will reach the file servers anyway. If the design files themselves stay encrypted and controlled, a copy taken in 15 minutes is still a copy nobody can use.
Protect your designs at the speed of today's attacks. CADChain gives engineering teams file-level encryption, per-file permissions, access logs and blockchain proof of ownership for CAD files, across CAD systems, partners and suppliers.

👉 Protect your CAD files with CADChain

FAQ: AI agent hacking frameworks and design data

What is ARTEX?

ARTEX is an open-source, multi-agent hacking framework that connects hacking tools to large language models. A planning agent splits an intrusion into tasks that other agents carry out. It was published on GitHub by a user called Autumn-27, who removed it in October 2026 because of abuse, but forks remain in circulation.

Which sectors were targeted?

CrowdStrike named US pharmaceutical, semiconductor, defence, nuclear and financial organisations, telecom providers and foreign ministries. Google named enterprise software, industrial automation, semiconductor manufacturing and design, telecom, government, technology, chemicals and materials, and manufacturing; another agent framework was used against the aerospace sector.

Was data stolen?

CrowdStrike confirmed post-exploitation activity at nine organisations but did not say what data, if any, was taken. Google described agents preparing large storage volumes, a typical step before copying data out.

Does AI create new hacking techniques?

Not according to Google and Mandiant. The agents used familiar techniques such as stolen credentials, password spraying and unpatched systems. The difference is speed: one cluster went from a first compromised account to deep access in about four hours, once in 15 minutes.

How can companies detect AI agent intrusions?

Watch for bursts of activity: many directory queries, password resets, new admin accounts or bulk file reads within seconds or minutes. ARTEX also leaves traces such as its own name in file and account names. Static indicators like hashes catch little of it.

How does CADChain help?

CADChain encrypts CAD files at file level, applies per-file permissions, logs access and timestamps files on a blockchain, so a design copied during an intrusion cannot be opened by unauthorised people and ownership can be proven. It does not replace patching, credential hygiene, monitoring or legal advice.