Chinese hacking group used AI agents against more than 200 organisations

A Chinese hacking group has used AI agents to attack a large number of organisations at the same time in a short period. The US security company CrowdStrike reported this on 29 October. AI agents are AI programs that carry out a series of steps on their own, such as exploring a computer or searching for passwords, without a human giving each step.

The group, which CrowdStrike calls VAPOR PANDA and which the company says is backed by the Chinese state, started on 17 October. In eleven days it targeted more than 200 organisations in at least 14 countries. They included foreign ministries in Latin America, Europe, Asia and the Middle East, telecom companies, and US companies in the chip, defence and pharmaceutical industries, among others. The office of a European president and a prime minister was also a target.

According to CrowdStrike, the attackers really got in at nine organisations and planted a backdoor: hidden software that lets them come back later. At no fewer than twelve other organisations, they tried to log in with stolen or guessed passwords.

One human, many agents

The group used ARTEX, a program originally meant for penetration tests: attacks that a security company carries out with permission to find weak spots. In ARTEX, one main agent gives orders to other agents. Some make a plan, others do the work. Everything they find, such as passwords and the layout of a network, goes into a shared overview. This allows many attacks to run at the same time.

A human did stay involved. According to CrowdStrike, an operator gave instructions in Chinese and stepped in only at important decision points, for example to have the agents search for an administrator's password. The agents ran mainly on the Chinese language model DeepSeek, supplemented by a second, paid language model that CrowdStrike could not identify. In one break-in, the planning agents processed about 1.4 billion tokens (pieces of text) of input.

Adam Meyers, head of research at CrowdStrike, told the trade publication CyberScoop that his company is seeing a state-backed group work with AI agents on this scale for the first time. Earlier this month, Microsoft reported that another group had used ARTEX. CrowdStrike expects Chinese groups to use such programs more often over the next twelve months.

How organisations can protect themselves

The attackers used known weak spots. At a pharmaceutical company, they combined two flaws in the way users log in. At a Greek government organisation, they used keys and VPN credentials that had leaked earlier and had never been replaced.

CrowdStrike has published the characteristics of the attacks so that other security teams can detect them. Among other things, the company advises replacing keys and passwords immediately if they may have leaked, including in backups. It also advises updating servers that can be reached from the internet quickly, and running security software on all computers in the network, including servers that are not connected to the internet. Meyers says the problem is not hopeless, as long as organisations actively take it on.

What does this mean for the road to the singularity?

AI agents are getting better at carrying out long, complex tasks on their own and at handling many tasks at once. This case shows that this also applies to people with bad intentions. At the same time, security companies quickly share what they see so that others can prepare, as CrowdStrike did here. The smarter agents become, the more important it is for organisations to get their basic security right, because the attackers in this case got in through known flaws and old, leaked keys.

What is the technological singularity? Read the explanation →