This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
The Chinese threat actor VAPOR PANDA utilized the ARTEX agentic framework, powered by the DeepSeek LLM, to conduct automated, parallel cyber intrusions against over 200 high-value organizations globally.
CrowdStrike reported that VAPOR PANDA, a China-linked espionage group, used ARTEX, an AI penetration-testing framework, with a DeepSeek language model and an unidentified commercial model to attack government and corporate systems worldwide. Investigators confirmed unauthorized access and follow-on activity at nine organizations, including backdoor deployment. More than 200 organizations were reportedly targeted.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to develop cyber weapons (e.g., by coding cheaper, more effective malware), develop new or enhance existing weapons (e.g., Lethal Autonomous Weapons or chemical, biological, radiological, nuclear, and high-yield explosives), or use weapons to cause mass harm.
Also classified as
The ARTEX framework demonstrated advanced, dangerous capabilities in autonomous cyber-offense, including multi-step planning, exploit execution, and defensive evasion.
The incident involves the malicious use of AI agent frameworks to automate and scale cyberattacks against critical infrastructure, government entities, and high-value corporate targets.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The cyber campaign was intentionally planned and executed by human threat actors (VAPOR PANDA) using deployed AI models as tools to conduct intrusions.
State-sponsored cyber espionage campaign by VAPOR PANDA leveraging the ARTEX multi-agent AI framework to conduct parallel intrusions against over 200 global targets. This represents a severe threat to critical infrastructure, government sovereignty, and strategic technology sectors through highly automated and scaled AI-enabled cyber operations.
The report describes ARTEX as an agentic framework that coordinates a main agent with subordinate planner and worker agents over a shared graph of facts, findings, and goals to execute parallel cyber intrusions.
High Risk: The AI system was utilized to target and compromise critical infrastructure sectors, including telecommunications, nuclear, and defense, which carries significant safety and security implications.
The AI system was used to generate malicious code (web shells) and identify vulnerable targets (hosts without the Falcon sensor) to execute cyberattacks.
The report from CrowdStrike provides highly detailed technical telemetry, specific dates, target sectors, and architectural details of the ARTEX agentic framework.
None
Technology
Agentic Attack Automation
ARTEX framework automated multi-agent parallel cyber intrusions.
Dual-Use LLM Capabilities
DeepSeek and commercial LLMs enabled sophisticated planning and execution.
Evasion Logic in AI Workflow
AI agents programmed to identify and avoid endpoint security sensors.
Data Inputs
Massive Token Consumption
Planning agents consumed 1.4B tokens, indicating large-scale data ingestion.
Ingestion of Stolen Credentials
AI agents ingested leaked directory exports and VPN keys to plan attacks.
Shared Graph of Facts
Agents coordinated via a shared graph of facts, findings, and goals.
Human Factors
Human-Directed AI Orchestration
Human operators issued instructions in Chinese to steer the AI agents.
Small Team Leverage
AI allowed a small team of operators to scale attacks across 200+ targets.
Operator-in-the-Loop Steering
Operator intervened only at critical decision points to guide the AI.
Process and Methods
Parallel Attack Path Execution
AI agents pursued multiple complex attack paths simultaneously.
Adaptive Strategy Shifting
AI agents shifted to alternative attack approaches when one path failed.
Public AI Resource Assembly
Adversaries built resilient toolchains from open source and commercial LLMs.
Management
State-Sponsored AI Adoption
VAPOR PANDA managed and funded the integration of AI into cyber operations.
Resilient Toolchain Strategy
Management designed a multi-model toolchain to avoid single failures.
Targeting Expansion Strategy
Management used AI to rapidly expand targeting into new critical sectors.
Regulatory Environment
Commercial LLM Access
Threat actors easily subscribed to and utilized commercial LLM services.
Open Source Model Proliferation
Unrestricted public availability of powerful models like DeepSeek.
Lack of Global AI Governance
No international frameworks to prevent malicious state-sponsored AI use.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
