CrowdStrike reports that China-linked group VAPOR PANDA used the open-source AI agent framework ARTEX, mainly powered by a DeepSeek model, to target more than 200 organisations in at least 14 countries over 11 days starting on 17 October. Targets included government ministries and companies in semiconductors, defence, pharmaceuticals, nuclear power, finance and telecoms. The company confirmed post-breach activity at nine organisations and credential attacks against at least 12 more. ARTEX works with agents that plan and carry out the steps, while a human operator gives instructions in Chinese.

What it means: The report is among the clearest evidence that AI has begun to change the scale of state-backed attacks. Traditionally an espionage team could handle a limited number of targets at once, because every step needed human work. With agents taking on reconnaissance, vulnerability testing and movement inside networks, a single operator can run hundreds of operations within days. Microsoft described another campaign using the same tool a week earlier, so ARTEX appears to be spreading among different groups. Using an open model also means attackers do not depend on providers that could detect and block the abuse. For defenders, speed is the key issue: attacks move faster than manual review processes, so automated detection, immediate patching of internet-facing systems and multi-factor authentication become essential. For Greek organisations in sectors such as defence, energy and finance, checking against the indicators of compromise CrowdStrike publishes is worthwhile. The findings show that the only effective answer is defence that moves just as fast.

Read the original on CrowdStrike

Related service: Custom software

Related stories