China-linked threat actors
Incidents involved as Deployer
インシデント 16464 Report
Suspected China-Linked Hackers Reportedly Used AI Agents to Compromise Taiwanese Government Systems and Exfiltrate Personnel Records
2026-07-01
From July 1–4, 2026, suspected China-linked hackers reportedly used a multi-agent framework built on Hermes and OpenClaw to compromise Taiwanese government systems. The agents reportedly compromised 85 credentials and used persistent access to connected systems to exfiltrate more than 2,564 personnel records. Taiwan later confirmed an overseas AI-assisted campaign against government agencies, without attributing it to China.
もっとインシデント 17812 Report
ARTEX AI Agents Reportedly Used Stolen Cloud Backup Credentials to Access ConnectWise Customers' Microsoft 365 Environments
2026-10-15
Microsoft reported that China-aligned hackers used ARTEX, an AI penetration-testing framework, to access customers' Microsoft 365 environments through stolen credentials for ConnectWise's cloud backup services. Agents reportedly changed credentials and privileges in some environments to retain unauthorized access. The activity formed part of a global campaign; the extent of compromise and any data theft remained uncertain.
もっとインシデント 17941 Report
China-Linked Espionage Group VAPOR PANDA Reportedly Used ARTEX AI Agents to Breach Government and Corporate Systems Worldwide
2026-10-17
CrowdStrike reported that VAPOR PANDA, a China-linked espionage group, used ARTEX, an AI penetration-testing framework, with a DeepSeek language model and an unidentified commercial model to attack government and corporate systems worldwide. Investigators confirmed unauthorized access and follow-on activity at nine organizations, including backdoor deployment. More than 200 organizations were reportedly targeted.
もっと