A Chinese-linked hacking group used AI agents to run large parts of a global cyberattack campaign, according to cybersecurity firm CrowdStrike. The firm shared its findings in a report released on Oct 29.
CrowdStrike calls the group VAPOR PANDA. The hackers used the DeepSeek AI model together with an AI agent tool named ARTEX to break into systems and steal data from organizations around the world.
How the AI Attack System Worked
The group did not use AI only to write code. Instead, it used ARTEX to direct several AI agents that worked together on the attacks.
DeepSeek handled the processing and planning behind the system. It helped guide the strategy the agents followed as they moved through each stage of an attack.
The system automated several steps of the operation. These included scanning networks for weak points and running trial break-ins against targets.
When an attack attempt failed, the system adjusted its methods on its own. This allowed the hackers to keep working against a target without changing their approach by hand.
The hackers also used AI to search for Windows computers that had no cybersecurity software installed. CrowdStrike said the group chose these machines on purpose to avoid being detected.
Once inside a network, the attackers used backdoor malware known as BLOODALCHEMY. The malware gave them ongoing control over the systems they had broken into.
In one breach, the AI system processed about 1.4 billion tokens of data. Tokens are the small pieces of text that AI models read and produce when they work.
Who Was Targeted
The campaign began on Oct 17 and reached organizations in roughly 14 countries. More than 200 organizations were targeted over a span of just 11 days.
The list of targets included government agencies, semiconductor makers and pharmaceutical companies. Nuclear energy facilities, financial institutions and telecommunications companies were also targeted.
Not every attack worked. Of the more than 200 organizations targeted, CrowdStrike confirmed that at least nine were successfully compromised.
One confirmed case involved a pharmaceutical company in the United States. The company’s name was not given in the reported details.
In Greece, the hackers gained unauthorized access to government emails. This was another specific incident that CrowdStrike identified in its findings.
CrowdStrike said it confirmed active intruder operations inside at least nine networks. These were the cases where the attackers were found working inside the systems they had breached.
The report linked all of the activity to VAPOR PANDA’s use of DeepSeek and ARTEX during the 11-day window. Details of CrowdStrike’s findings were published by the Bangkok Post on Nov 9, 2026.
