CrowdStrike links China-nexus group to AI-agent intrusions across 200 organizations

CrowdStrike said a China-nexus espionage group it tracks as Vapor Panda used AI agents to attack more than 200 organizations during an 11-day intrusion that began October 17. CrowdStrike said it began using the agentic framework ARTEX on October 17. The activity marked the first time CrowdStrike observed Vapor Panda using AI tooling, and the group’s target list has grown with it. A single ARTEX controller directed operations against organizations in at least 14 countries.

CrowdStrike said on Dec. 4 that VAPOR PANDA used DeepSeek and ARTEX to attack at least 200 institutions in 14 countries, and that the operation ran for 11 days starting on Nov. 17, according to CHOSUNBIZ. CrowdStrike’s account as reported by Help Net Security and BleepingComputer says the group began using ARTEX on October 17. The two dates conflict.

Targets included foreign ministries across Latin America, Europe, Asia and the Middle East, United States defense and semiconductor companies, and telecom providers. CrowdStrike confirmed post-exploitation at nine organizations where Vapor Panda installed the BloodAlchemy backdoor. The group also conducted password spraying against at least 12 other organizations, including United States think tanks and European government bodies.

Confirmed victims include telecommunications providers in the United States and Belgium, government agencies in Greece, the Middle East and Latin America, and pharmaceutical firms in the United States. In one European country, the Ministry of Foreign Affairs, the presidential office, the prime minister’s office, and defense, justice, finance and intelligence agencies faced intensive targeting. In the United States, 19 institutions in the pharmaceutical, semiconductor, defense, nuclear and finance sectors were targeted. Telecom operators in the United States, Belgium and the Philippines were found compromised.

A main agent delegated tasks to planner and worker agents that recorded findings in a shared graph, and when one attack path failed the agents switched to another path using familiar techniques. Planning agents processed roughly 1.4 billion input tokens. ARTEX ran on DeepSeek and on a second commercial language model that CrowdStrike could not identify. ARTEX AI is a penetration testing suite created by Chinese developers that began as open source before becoming proprietary following real-world attacks, including one against South Korean financial institutions.

CrowdStrike said the agents gathered intelligence on target networks, broke into vulnerable systems, installed web shells, harvested credentials, and looked for other ways into the network.

Before these campaigns, most documented attacker use of AI was for preparation such as writing phishing e-mails, fixing code, and researching vulnerabilities. In these campaigns, the model is part of the intrusion itself.

In both campaigns, a human operator chooses targets and sets goals, and a large language model then decides which commands to run and sends them to an implant on the victim network. Recovered transcripts show the operator intervening at decision points with instructions written in Chinese. Operators explicitly instructed agents to skip Windows machines protected by CrowdStrike Falcon and focus on unprotected hosts.

Against a Greek government entity, the operator gave the agent a 2022 mail server directory export containing authentication keys likely not rotated since the export. The agent used the keys to forge an administrator token and read mailboxes, then leveraged VPN configurations found in a user’s sent mail to enter the internal network. The operator said the VPN client key came from a May 2024 email leak.

At one pharmaceutical firm, an agent used an unsigned SAML assertion alongside an XXE flaw to access cloud instance metadata and then reached an enterprise admin account. At a United States pharmaceutical corporation, an AI agent linked multiple vulnerabilities to enter a cloud system and then took administrator privileges. At a different pharmaceutical corporation, the attackers deployed a web shell and gained superuser privileges inside a container environment. Chat logs recovered by investigators contained instructions for the AI to build a malicious web shell and to pull administrator passwords.

Kaspersky published details on Monday of a separate campaign against educational institutions in Africa and Latin America, mounted by Chinese-speaking operators. The two campaigns do not appear connected, and Kaspersky did not link the educational institution activity to a known threat group.

Attackers in that campaign used CyberStrikeAI, an open-source penetration testing framework written in Go. The language model ran on the attacker’s command-and-control server, planning next steps and generating commands, while the victim implant had no AI and executed received commands. Kaspersky researchers said CyberStrikeAI originated in the Chinese cybersecurity community and remains well known there. Indicators of a Chinese-speaking operator include Chinese script comments, reliance on the Chinese service dnslog.cn, and command-and-control restarts concentrated during UTC+8 business hours.

The intruders gained access manually via a compromised SQL Server, remained active for roughly one day, then disappeared for two weeks. After agent deployment, persistence and local reconnaissance took two minutes, and domain mapping took about five hours. A few days afterward, the attackers completed lateral movement, credential dumping on many hosts, and a database export in under one hour. From agent deployment to compromise of domain admin accounts, the entire intrusion took three to four days.

The Dutch Institute for Vulnerability Disclosure said it suffered a cyber attack in September 2026 that it attributed to an AI agent. DIVD said the tool used against its network was ARTEX AI, which acted autonomously. The DIVD attack moved from initial access to root privileges in 12 minutes. Attackers chained a Zammad zero-day with a second zero-day for local privilege escalation.

DIVD said its agent worked on many jobs at once: it opened a hacked mailbox, scanned the network inside, pulled login tokens, and tried to reset passwords. DIVD counted more than 450,000 requests and 2,500 scripts tied to the attack and described the activity as super loud and messy.

Kaspersky researchers said AI in the attack chain does not yet create fundamentally new detection challenges because all intelligent work remains on the attacker side while the compromised host undergoes familiar actions. Familiar actions include reconnaissance via Kerberoasting and AS-REP Roasting, LSASS dumps, DCSync, and Golden Ticket attacks. The novelty is the speed and ease of execution, Kaspersky researchers added.

CrowdStrike said detection only helps where deployed, and the operators sought gaps in coverage. CrowdStrike advised rotating keys and credentials after suspected exposure. CrowdStrike also advised enforcing SAML signature validation and IMDSv2. CrowdStrike also advised hunting for ARTEX markers, patching internet-facing appliances, and running EDR everywhere.

Microsoft reported separate ARTEX activity by the Storm-0940 group, suggesting the ARTEX framework is spreading among China-nexus groups, CrowdStrike noted. CrowdStrike analyzed that AI cyber attacks are evolving from individual system intrusions to methods that simultaneously target multiple countries and institutions. CrowdStrike said even small hacking groups can attack far more targets if they use AI agents.

CrowdStrike said commercial LLMs would help small teams expand intrusions across many targets. “China-nexus adversaries will highly likely continue adopting agentic frameworks such as ARTEX over the next 12 months,” CrowdStrike said. “China-linked hacking groups will increasingly combine AI agent frameworks like ARTEX with commercial AI models,” CrowdStrike said.

Kaspersky researchers expect the techniques used by these tools to grow more sophisticated as models improve. The operator’s job will move from task assignment to watching the model’s actions, Kaspersky researchers said.