Chinese Group Ran an AI Agent on DeepSeek Against 200+ Targets in 14 Countries, CrowdStrike Says
CrowdStrike attributes the campaign to VAPOR PANDA, a group the company has tracked since the ProxyLogon exploitation in 2021. But only nine breaches are confirmed — and it was an operational security slip that exposed the attackers.
A Chinese state-linked cyber espionage group used an AI agent tool powered by the DeepSeek language model against more than 200 organizations in at least 14 countries over eleven days beginning October 17, according to the security firm CrowdStrike. CrowdStrike published its findings on Thursday, October 29 — an analysis the company itself describes as the group's first observed use of AI-driven intrusion tooling, and one of the broadest automated espionage campaigns documented to date (HNGN).
The group behind the attacks is tracked as VAPOR PANDA. The number that must be kept distinct throughout this story is 200 versus nine: more than 200 organizations were attacked or targeted, but CrowdStrike has only confirmed that the attackers gained access and carried out follow-on activity at nine of them. That is not 200 confirmed breaches.
The Group and the Campaign
CrowdStrike has tracked VAPOR PANDA since early 2021, when the group exploited the ProxyLogon security flaws in Microsoft Exchange servers. Previous targets have included think tanks, local governments, and energy companies. The new campaign, according to the company, marks an expansion into pharmaceutical, semiconductor, nuclear power, and defense organizations.
The targeting was broad. Among the targets were foreign ministries, 19 U.S. organizations in the pharmaceutical, semiconductor, nuclear, and defense sectors, and telecommunications providers in the United States, Belgium, and the Philippines. Two of the nine confirmed victims were American pharmaceutical companies. In addition to the nine confirmed breaches, CrowdStrike states that at least 12 other organizations were subjected to attacks against login credentials that are not counted as confirmed intrusions.
How It Worked
The tool is called ARTEX. It is an open-source agent for penetration testing, published on GitHub this year by a Chinese security engineer. The agent takes a goal from a human operator, and then chains reconnaissance, exploitation, and lateral movement on its own — making a language model call to determine each next step.
VAPOR PANDA ran the framework primarily on DeepSeek, the Chinese-developed model that became a global phenomenon in early 2025. In addition, a second, subscription-based commercial model was used that CrowdStrike was unable to identify.
The scale of the automation is striking. According to CrowdStrike's analysis, as reported by The Hacker News, the group's planning agents consumed on the order of 1.4 billion input tokens in a single intrusion. "In a single intrusion, Vapor Panda's planning agents consumed on the order of 1.4 billion input tokens, indicating the scale of the automated activity and implying far higher consumption across the operation as a whole," the analysis states. The quotation is translated from English.
What AI Actually Changed
The core analytical point in CrowdStrike's findings is not that AI changed the group's mission — but that agentic tooling changed its pace and breadth. "Agentic tooling like ARTEX enables this scale of expansion at speed, allowing a small team to pursue a wider target set than manual operations would support, rather than a wholesale shift away from the adversary's established access-development mission," the analysis published Thursday states, as reported by The Hacker News. The quotation is translated from English.
In other words: the human remained in the loop throughout. The operator set the goal, and the agents executed the steps. This is AI accelerating human operators, not autonomous attacks — and nine confirmed breaches is a different figure from 200 attacked organizations, a clarification that makes all the difference in how the findings should be read. Independent commentary has likewise underscored this caveat: the reports describe AI as an accelerating tool for human operators, not autonomous attacks, and the confirmed breach count is nine, not 200 (Tehrani on Tech).
It is this economics that constitutes the concrete change: a small team can now cover a target volume and pace that previously required far more people, as NBC News frames its coverage of the campaign.
The Slip That Exposed Everything
CrowdStrike gained insight into the operation because the attackers' controller intermittently exposed their own tools, target files, and agent transcripts — an operational security failure that, according to the company, has become a recurring feature of AI-assisted intrusions. The same pattern appeared in a separate ARTEX case on October 7, in which attacks against South Korean financial institutions exposed data on roughly 25,000 bank customers.
That sophisticated agent-driven operations can be traced because the attackers leak their own agent logs is one of the few unambiguously positive takeaways for defenders — but it is also a reminder that this attack pattern is still young and operationally fragile.
The Context and the Open Questions
The findings land amid a series of related disclosures: ARTEX-based intrusions against South Korean financial institutions reported on October 7, and CrowdStrike's earlier assessments of AI use among Chinese and Russian groups. AI agent tooling in espionage is thus no longer a hypothetical scenario, but a tool in active use by state actors.
Several questions remain open. DeepSeek has not publicly commented on the findings, according to available coverage, and there is no comment from Chinese authorities in the sources available for this story. The second language model in the attackers' toolbox remains unidentified. It is also not known to what extent the remaining targets in the campaign will turn out to be actual breaches — CrowdStrike's nine confirmed cases are based on what the company could verify, and the figure may evolve.
An important caveat about the evidence base: all the details in this story come from secondary coverage of CrowdStrike's analysis — HNGN, NBC News, and The Hacker News. AIMag has not reviewed the primary report from CrowdStrike. This does not mean the findings are weakened, but that their precision stands or falls with CrowdStrike's own documentation, which has not been independently verified in this coverage.