Executive Summary
Since October 2026, the China-based threat actor Vapor Panda (also known as Earth Estries) has significantly scaled its operations using ARTEX, a Go-based agentic AI penetration testing framework. By leveraging Large Language Models like DeepSeek, the adversary has targeted over 200 high-value organizations simultaneously, including foreign ministries, telecommunications providers, and defense sectors across Latin America, Europe, Asia, and the U.S.
The campaign demonstrates a shift toward automated, parallelized attack paths where AI agents autonomously perform reconnaissance, exploitation, and lateral movement under human supervision. This approach allows a small team of operators to maintain a massive operational footprint, shifting between attack vectors—such as cloud services, container environments, and Active Directory—when initial paths are obstructed.
Furthermore, newly identified clusters including Overcast Panda and Titan Panda highlight a diverse Chinese threat landscape. These groups utilize specialized tools like the FlowCloud backdoor for physical access compromise and the IceGiant framework for exploiting legal billing software vulnerabilities, emphasizing a high level of technical sophistication and persistence across global infrastructure.