One operator, 200+ targets: China-linked hackers ran an AI agent swarm for 11 days

CrowdStrike says a China-nexus group it tracks as VAPOR PANDA used the open-source ARTEX agent framework, DeepSeek and a second commercial model to target more than 200 organizations in 11 days. Post-exploitation was confirmed at nine, according to the company’s report as relayed by Techmeme, which cites NBC News.

One human operator directing many intrusions at once

CrowdStrike’s OverWatch team says the activity reached entities in at least 14 countries. At nine organizations the attackers gained access, deployed a backdoor called BLOODALCHEMY and carried out follow-on activity. Password spraying and credential scanning hit others.

The company describes the main shift as scale. In ARTEX, a main agent coordinates planner and worker agents that share a graph of facts, findings and goals, and move each engagement from initial access through reconnaissance to lateral movement. DeepSeek was the primary model. CrowdStrike says it could not confirm the second, a subscription-based commercial one, and reads the multi-provider setup as a resilience measure.

A human stayed in the loop. Recovered transcripts show instructions written in Chinese and timestamped in China Standard Time. In one, the operator told the agents to find Windows machines lacking the CrowdStrike Falcon sensor, then focused later activity on them.

Ministries, pharma and telecoms among the targets

According to CrowdStrike, foreign ministries in two Latin American countries were hit, a Middle Eastern interior ministry was compromised, and so was a Greek government entity. Telecom providers were compromised in the US, Belgium and the Philippines. One US engagement went after 19 organizations across pharmaceuticals, semiconductors, defense, nuclear, finance and think tanks.

The report says the agents needed no new exploit. At the Greek entity, an old mail server export held keys that were likely never rotated, and the agent used them to forge an admin token and read mailboxes. CrowdStrike’s advice follows from that: rotate signing and service credentials after suspected exposure, enforce SAML signature validation, require IMDSv2, patch internet-facing systems and run endpoint detection on every server. It also lists hunting markers such as command lines containing “artx” or “artex” and the C:\ProgramData\artx5v\ directory.

The second ARTEX case in weeks

Earlier this month CrowdStrike said a suspected Chinese-speaking, financially motivated actor used ARTEX with DeepSeek as its main model, plus Anthropic’s Claude Code, against South Korean financial institutions, as iTnews reported. That case involved a criminal motive. This one is attributed to an espionage group.

CrowdStrike says VAPOR PANDA has targeted government, think tank, energy and extractive organizations since 2021, mainly for long-term access. It calls this the group’s first observed use of AI-driven intrusion tooling, and says other China-linked actors have used ARTEX separately. The point, as the company frames it, is leverage: a small team can now run what once took many operators in parallel.

What the report does not establish

Attribution rests on CrowdStrike’s own assessment, drawn from its telemetry and recovered transcripts, and has not been independently verified. The report does not name the second commercial model, and it does not say how many other targets were breached beyond the nine confirmed. It also does not claim that DeepSeek or any model provider took part knowingly. For defenders, the blog lists command-and-control domains, IP addresses and file hashes.