Cybersecurity firm CrowdStrike revealed in a report on Oct 29 that Chinese-linked hacking group VAPOR PANDA used DeepSeek AI alongside an AI agent tool named ARTEX to breach systems and steal data from organisations worldwide.
The hacking operation began on Oct 17 and targeted more than 200 organisations across roughly 14 countries in just 11 days.
The targets spanned government agencies, semiconductor manufacturers, pharmaceutical firms, nuclear energy facilities, financial institutions and telecommunications companies, with at least nine organisations confirmed to have been successfully compromised.
Rather than relying on AI simply to generate code, the group employed ARTEX to orchestrate multiple AI agents working in tandem. Powered by DeepSeek for processing and strategy, the system automated several attack phases, ranging from scanning for vulnerabilities and conducting trial breaches to dynamically adjusting attack methods when initial attempts failed.
CrowdStrike identified specific incidents, including the compromise of a US pharmaceutical firm and unauthorised access to government emails in Greece. The hackers also leveraged AI to scan for Windows machines lacking cybersecurity software, strategically selecting targets to avoid detection.
Attackers used backdoor malware known as BLOODALCHEMY to maintain persistent control over compromised networks. In one specific breach, the system processed approximately 1.4 billion tokens of data using AI.
While not all 200 targeted organisations were breached, CrowdStrike confirmed active intruder operations inside at least nine networks.
The operation underscores how artificial intelligence is evolving into a critical asset for cybercriminals, enabling fully automated, multi-stage attacks against numerous targets in unprecedentedly short timeframes.
