China-linked spies targeted 200+ organizations using AI agents, CrowdStrike says

“Find the Windows machines in the domain without Falcon.” The instruction, written in Chinese, was not addressed to a hacker but to artificial intelligence agents. CrowdStrike found it in the exchanges of an espionage campaign it attributes to Vapor Panda, a China-linked group. The operator asks the agents to locate computers not protected by Falcon, CrowdStrike's endpoint security product, so the attack can focus on them.

In a report published on October 29, the U.S. security vendor says the group targeted more than 200 organizations in at least 14 countries, over eleven days starting October 17, from a single control point. It confirmed malicious post-intrusion activity at nine of them.

Who was in the crosshairs?

The list is broad: foreign ministries in Latin America, Europe, Asia and the Middle East, presidential, prime minister's, justice and intelligence offices, telecom operators, and, in the United States, companies in semiconductors, defense, pharmaceuticals, nuclear power and finance, as well as think tanks. CrowdStrike cites a Greek government body and a Belgian telecom operator. France is not named.

The tool is called ARTEX: a framework in which a main agent coordinates planner and executor agents that share what they discover. According to CrowdStrike, it ran mostly on DeepSeek, the Chinese AI model, with a second commercial, subscription-based model that the vendor could not identify. In a single intrusion, the planner agents consumed about 1.4 billion input tokens.

Autonomous AI? Not really

CrowdStrike stresses that a human operator directed several attacks in parallel and stepped in at decision points. The agents did the work: writing malicious web pages (webshells), extracting administrator passwords, and taking inventory of security protections.

The entry points, however, are conventional. No new vulnerability was cited, just misconfigurations and oversights: unsigned SAML assertions combined with an XML external entity (XXE) flaw, a container orchestration service with no authentication, and a 2022 directory export containing keys that were probably never changed, which made it possible to forge an administrator token and read mailboxes. In two ministries, the attackers installed the BloodAlchemy backdoor.

What CrowdStrike recommends

The advice follows directly from these entry points:

• rotate signing keys and service credentials after any possible leak, including those sitting in old backups;
• require signed SAML assertions and version 2 of the cloud instance metadata service (IMDSv2), and limit the permissions of cloud roles;
• patch internet-facing devices, especially old Linux servers;
• look for traces of ARTEX, such as the strings “artx” or “artex” in command lines and the folder C:/ProgramData/artx5v/ (written with backslashes on Windows).

ARTEX is not new: CrowdStrike had already spotted it in the hacking of South Korean banks. What has changed is the scale. The vendor expects other China-linked groups to adopt this type of tool within the next twelve months.