A China-linked group used AI agents against more than 200 organizations, CrowdStrike says
IA en un minuto newsroom · Editor: Jon Elgezabal
In 30 seconds
CrowdStrike ties VAPOR PANDA, a China-linked group, to an 11-day campaign in which AI agents coordinated through the ARTEX framework targeted over 200 organizations in at least 14 countries. The company confirms that attackers were active inside nine of them and tried to guess passwords at 12 others as a minimum. Targets included foreign ministries from several regions.
Security firm CrowdStrike said on October 29, in a blog post, that a China-linked group it tracks as VAPOR PANDA went after more than 200 organizations across at least 14 countries during an 11-day stretch beginning October 17.
The group relied on ARTEX, a framework (a set of tools) in which one lead agent directs other agents that plan and carry out tasks. CrowdStrike says it runs mostly on DeepSeek, plus a second paid commercial model that the company could not confirm.
CrowdStrike confirms activity after access at nine organizations, where the group installed BLOODALCHEMY, a backdoor (a hidden way into a system), and says it also tried to guess passwords at a minimum of 12 others. The targets included foreign ministries in Latin America, Europe, Asia and the Middle East.
Transcripts show an operator issuing commands in Chinese: asking the agents to write web shells (programs that give remote control of a web server), pull out domain administrator passwords and look for Windows machines lacking CrowdStrike's Falcon sensor. The company calls it an escalation in how China-linked groups use AI agents, and adds that the group ran several operations in parallel.
CrowdStrike makes clear that this campaign is separate from the ARTEX activity that other industry sources linked to Storm-0940.
Why it matters · analysis and opinion
What CrowdStrike points to is not a new technique but scale: a single operator giving orders to agents that write tools, look for machines and try passwords can open many doors at once. Small companies are not the target in this case, which aims at ministries, but the tactics described, such as guessing passwords or exploiting unprotected machines, are the same ones any business faces. The practical steps are to switch on two-step verification, check that every computer has its security sensor installed and watch for repeated sign-in attempts. It remains to be seen how much of the activity the agents did on their own and how much the operator did.
Source: CrowdStrike · Written with the help of AI: how we make the news
