CrowdStrike: China-linked hackers used a DeepSeek-powered agent system to target more than 200 organizations in 11 days

The scale of the campaign

CrowdStrike’s Counter Adversary Operations team disclosed on Oct. 29 a global espionage campaign in which the China-nexus group VAPOR PANDA used AI agents. According to CrowdStrike, the group has mainly targeted government bodies, think tanks, and energy and extractive companies in Europe, North America, Oceania and the U.K. since 2021, seeking long-term access. This campaign is the first time the group has been observed using AI-driven intrusion tooling. With it, the group broadened its targeting to the pharmaceutical, semiconductor, nuclear and defense sectors and to foreign ministries in new regions.

The activity began on Oct. 17. A single ARTEX controller targeted entities in at least 14 countries over an 11-day window, and the group used ARTEX against more than 200 distinct organizations worldwide in total. Not all of them were breached. CrowdStrike confirmed post-exploitation activity at nine organizations, where the attackers deployed the BLOODALCHEMY malware and carried out credential spraying, network scanning and reconnaissance. At least 12 more organizations, including U.S. think tanks and European government entities, faced password spraying and credential scanning.

How ARTEX works

According to CrowdStrike, ARTEX coordinates a main agent with subordinate planner and worker agents over a shared graph of facts, findings and goals. The group ran ARTEX primarily with the Chinese-origin DeepSeek model, supplemented by a second, subscription-based commercial model that CrowdStrike could not confirm. In a single intrusion, the planning agents consumed on the order of 1.4 billion input tokens.

A human operator was in the loop. Recovered transcripts show the operator’s instructions in Chinese, labeled “human instruction” and timestamped in China Standard Time. The operator told the agents to write web shells, extract domain administrator passwords and inventory endpoint sensor coverage. At a global pharmaceutical organization, the agents were told to find Windows machines in the domain that did not have Falcon, CrowdStrike’s own security software. CrowdStrike notes that it previously documented ARTEX and similar frameworks in use by financially motivated and unattributed actors, and that Microsoft reported separate ARTEX activity under the name Storm-0940.

Steps of the attack

According to the report, the agents took part in nearly every stage of the attack chain. At a U.S. pharmaceutical organization, an agent chained an unsigned SAML assertion with an XXE flaw to query the cloud instance metadata service. From there it obtained a cloud role able to issue commands to thousands of instances and read LAPS passwords. The agents deployed web shells and abused resource-based constrained delegation (RBCD) to impersonate a privileged account.

At a Greek government entity, the operator gave an agent a 2022 directory export whose keys had likely never been rotated. The agent used it to forge an administrator token, read mailboxes and reach the internal network with VPN configurations and a VPN client key obtained from a May 2024 email leak. BLOODALCHEMY was launched through a GameHook binary renamed svchost.exe that loaded a malicious DLL, and it communicated with VAPOR PANDA’s command-and-control infrastructure.

Affected organizations and outlook

The breached organizations include the foreign ministries of two Latin American countries, a Middle Eastern interior ministry, and telecommunications providers in the U.S., Belgium and the Philippines. CrowdStrike also reported an enterprise admin account taken over at a U.S. pharmaceutical organization, root access in a production container at a second U.S. pharmaceutical organization and internal network access at a Greek government entity. Targets also included a European country’s foreign ministry, presidency and prime minister’s office, as well as U.S. organizations in pharmaceuticals, semiconductors, defense, nuclear and finance. The only countries named in connection with this campaign are the U.S., Belgium, the Philippines and Greece; other organizations are identified by region.

CrowdStrike says the campaign marks an escalation in China-nexus use of AI agents, from single intrusions to multiple simultaneous engagements directed by a human operator. It assesses that the tooling mainly expands the group’s scale rather than changing its access-development mission. It also expects China-nexus adversaries to highly likely continue adopting agentic frameworks such as ARTEX over the next 12 months. NBC News wrote that the campaign shows AI allowing hackers to operate on a scale that previously required far more human effort. NBC’s report carries no response from the Chinese government or DeepSeek.