A China-linked hacking group used artificial intelligence to target more than 200 organizations in 14 countries over an 11 day period, compromising about 70% of them, according to a report from CrowdStrike. The group, known as Vapor Panda, launched the campaign on Oct 17, breaching approximately 140 targets including 19 U.S. entities in the nuclear, defense, semiconductor, pharmaceutical and financial sectors, as well as European prime minister and presidency offices.
The attackers used the ARTEX agentic AI framework and DeepSeek large language models to automate the intrusion process, increasing the speed of operations from 40 to more than 1,500 commands per hour. The activity follows a supply chain breach of ConnectWise Cloud Backup, which allowed hackers to bypass multi factor authentication and gain access to Microsoft 365 tenants. Microsoft previously attributed this operation to the Storm-0940 threat actor, noting that some AI-driven intrusions achieved privileged cloud access in under 3 hours.
