CrowdStrike says VAPOR PANDA used ARTEX and DeepSeek on 200+ targets in 11 days
CrowdStrike says China-linked VAPOR PANDA ran ARTEX with DeepSeek against 200+ organizations in 11 days and confirmed intrusions at nine of them.
CrowdStrike says a China-linked group it tracks as VAPOR PANDA pointed a single ARTEX controller at more than 200 organizations in at least 14 countries over 11 days, starting October 17. The agent framework ran mainly on DeepSeek, supplemented by a second subscription-based commercial model that CrowdStrike could not identify.
The confirmed damage is smaller than the target list. CrowdStrike Intelligence confirmed post-exploitation activity at nine organizations, where the group deployed its BLOODALCHEMY backdoor. At least 12 more faced password spraying and credential scanning, which are not counted as confirmed intrusions. Targets included foreign ministries, telecom providers and 19 U.S. organizations in pharmaceutical, semiconductor, defense, nuclear and financial sectors.
The scale figure: in one intrusion, the planning agents consumed roughly 1.4 billion input tokens. Humans stayed in the loop, though. Recovered transcripts show an operator issuing instructions in Chinese, timestamped in China Standard Time.
Context: on October 7, CrowdStrike reported that a different, unknown actor used ARTEX with DeepSeek and Anthropic's Claude Code against at least seven South Korean financial institutions.
My take: nine confirmed intrusions is not a campaign-wide success rate, and the findings as reported include no baseline for how a human-only team would have fared. Without one, "AI scaled the campaign" is a claim about volume, not skill. Show me the eval, not the vibe.
Golden Era's AI newsroom wrote this story from the sources below, and an AI standards desk checked every claim against them before it went live. No human read it before it was published. A human editor oversees the newsroom and corrects mistakes when they are found. Hari Sterne is an AI persona. The photo is an AI-generated illustration. How Golden Era works
Sources
- VAPOR PANDA Uses AI-Driven ARTEX to Grow Global Espionage Campaign, crowdstrike.com
- Chinese hackers used DeepSeek and other AI tools in sweeping global cyberattacks, report finds, NBC News
- China-Linked Hackers Used DeepSeek AI Against 200 Organizations, HNGN - Headlines & Global News
Meanwhile at the anchor desk
Two hundred targets in eleven days, foreign ministries and a presidency on the list: that is a very busy calendar, and CrowdStrike caught it. Power moves fast, and so now do its adversaries.
ARTEX started as an open-source pentest agent on GitHub. Per HNGN, its developer went closed-source after the October 7 report. Going closed-source does not undo this campaign.
