Chinese-linked groups use AI agents to attack over 200 organizations in 11 days
Original title: AI agents scale and speed up Chinese-linked attacks
CrowdStrike reports China-nexus group Vapor Panda used ARTEX AI framework to attack organizations in 14 countries, installing BloodAlchemy backdoor.
A China-nexus espionage group tracked as Vapor Panda started using agentic framework ARTEX on October 17. Over 11 days a single controller was used against organizations in at least 14 countries including foreign ministries, US defense and semiconductor companies, and telecom providers. Post-exploitation activity at nine organizations with BloodAlchemy backdoor installed. Password spraying against at least 12 others including US think tanks and European government bodies. The framework ran mostly on DeepSeek and another commercial LLM. A separate campaign against educational institutions in Africa and Latin America used CyberStrikeAI, an open-source penetration testing framework written in Go. From agent deployment to domain admin compromise took three to four days. Defenders should rotate keys and credentials, enforce SAML signature validation, hunt for ARTEX markers, and patch internet-facing appliances.
Unconfirmed: Kaspersky did not link the activity to a known group
- Vapor Panda used ARTEX against organizations in 14 countries
- Post-exploitation at nine organizations with BloodAlchemy backdoor
- Similar campaign by Chinese-speaking operators using CyberStrikeAI
- Domain admin compromise in three to four days from agent deployment
- AI agents enable small teams to scale intrusions across many targets
- 1.Rotate keys and credentials after suspected exposure
- 2.Enforce SAML signature validation and IMDSv2
- 3.Hunt for ARTEX markers and patch internet-facing appliances
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | dnslog.cn | Chinese comments in the scripts, use of the Chinese service dnslog[.]cn , and C2 server restarts that mostly happened during busi |
From the original article
4 min read at helpnetsecurity.com
A China-nexus espionage group used AI agents to attack more than 200 organizations in 11 days, CrowdStrike said last week. On Monday, Kaspersky published details of a separate campaign against educational institutions in Africa and Latin America, mounted by Chinese-speaking operators.
By Zeljka Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.