China-linked hacking organization attacks over 200 locations in 14 countries with AI

Circumstances were discovered that a Chinese-linked hacking organization was using autonomous artificial intelligence (AI) tools to conduct large-scale cyber espionage targeting more than 200 government agencies and companies around the world.

The tool used in the attack was 'ARTEX', which has been exploited in recent serial hacking of the domestic financial sector. It was found to have been combined with the Chinese AI model 'DeepSeek' to simultaneously attack government agencies and strategic industries in several countries.

According to CrowdStrike, an American cybersecurity company, on the 4th, the company's threat hunting organization 'Overwatch' discovered that the Chinese-linked hacking organization 'VAPOR PANDA' used Artex to attack major organizations and companies around the world.

For 11 days from the 17th of last month, a single Artex control server detected vulnerability exploitation activities targeting more than 200 organizations in at least 14 countries, and the scope of the attack was wide, ranging from diplomatic and security agencies in Central and South America, Europe, Asia, and the Middle East to high-tech companies such as the semiconductor and defense industries in the United States.

In Central and South America, extensive infiltration occurred targeting the ministries of foreign affairs of two countries, and a breach was also confirmed in an interior ministry in the Middle East. In Europe, a country's Ministry of Foreign Affairs, Office of the President, Office of the Prime Minister, as well as defense, legal, financial, and intelligence agencies were targeted for attack.

In the United States, 19 organizations in the pharmaceutical, semiconductor, defense, nuclear, and financial sectors were targeted. The attack targeted the nation's core infrastructure and strategic industries as a whole, with breaches also confirmed at telecommunications providers in the United States, Belgium, and the Philippines.

Vaporpanda mainly ran Artex, an autonomous AI agent penetration testing tool, with the Chinese AI model DeepSearch, and also used one unconfirmed subscription-type commercial LLM as an auxiliary feature. In a single penetration, the input tokens consumed by Vaporpanda's planning agents amounted to approximately 1.4 billion.

Artex is a tool that was previously suspected of being used in a series of cyber attacks that occurred in the domestic financial sector last month.

CrowdStrike predicted that it is highly likely that Chinese-linked hacking organizations will continue to adopt AI agent-based infiltration tools such as Artex over the next 12 months.