CrowdStrike links DeepSeek AI to VAPOR PANDA cyber campaign

CrowdStrike said VAPOR PANDA used DeepSeek alongside ARTEX, which the company described as coordinating multiple AI agents rather than simply generating code.[1] DeepSeek powered ARTEX’s processing and strategy, according to CrowdStrike.[1] ARTEX automated vulnerability scanning, trial breaches and changes in approach when attempts failed.[1] CyberScoop reported that ARTEX requests occurred as often as every 10 seconds, allowing multiple attack paths to be pursued at once.[2] Meyers said activity could exceed 1,500 commands an hour.[2]

CrowdStrike said the campaign began on Oct. 17 and targeted organisations for 11 days.[1] The targets numbered more than 200 across roughly 14 countries and included government agencies, semiconductor manufacturers, pharmaceutical firms, nuclear energy facilities, financial institutions and telecommunications companies.[1] CrowdStrike confirmed at least nine successful compromises.[1] Bangkok Post reported a compromise at a U.S. pharmaceutical firm and unauthorised access to government emails in Greece.[1] CyberScoop reported about 140 sensitive targets compromised in 11 days.[2]

CyberScoop said about 70% of VAPOR PANDA’s targets were confirmed compromised or had evidence indicating moderate confidence of a successful intrusion.[2] That measure includes varying levels of confidence, while CrowdStrike separately confirmed at least nine organisations were compromised.[1][2] In one breach, the system processed approximately 1.4 billion tokens of data using AI.[1] CrowdStrike also said the hackers used BLOODALCHEMY backdoor malware to maintain persistent control of compromised networks.[1] The reported figures describe this campaign and should not be treated as a confirmed count of successful breaches across every target.

Meyers called the operation the first instance he had seen of an agentic nation-state threat actor operating at this scale and said he expected more such activity.[2] CrowdStrike said it observed about 45 agentic adversary attacks in September and 126 in October, with the October count still rising.[2] The company said malicious use of agentic AI was growing month over month at nearly threefold.[2] Meyers said the attacks operated at a speed and scale organisations were unaccustomed to.[2] CyberScoop reported that the campaign remained active at the time of its reporting.[2]