China cyber operations are drawing fresh scrutiny after CrowdStrike reported that hackers used DeepSeek AI to target organizations worldwide, showing how tools built to speed up every day work can also help attackers reach sensitive networks and steal valuable information.
The cybersecurity company said in an October 29 report that the Chinese-linked group VAPOR PANDA targeted more than 200 organizations across roughly 14 countries in 11 days. At least nine organizations were compromised. The findings put the China cyber espionage threat in practical terms: government emails, corporate research and essential communications can become targets within the same campaign.
One Operation, Hundreds of Targets
The campaign began on October 17 and reached government agencies, semiconductor manufacturers, pharmaceutical businesses, nuclear energy facilities, financial institutions, and telecommunications companies. CrowdStrike’s findings suggest China cyber operations can gain speed when attackers combine human direction with software that coordinates several tasks at once.
The VAPOR PANDA hackers used ARTEX, a GO-based penetration testing framework that organized multiple AI agents, alongside DeepSeek. Planner and worker agents scanned for weaknesses, attempted intrusions and adjusted their methods when initial approaches failed, with a human operator supervising. According to CrowdStrike, ARTEX was built by a developer identified as Li Puhua, who has since taken the tool closed source.
Calling this a DeepSeek AI hack describes the model’s use by attackers, but the report does not establish that DeepSeek itself was breached. CrowdStrike also disclosed that the operators ran ARTEX with a second subscription-based commercial model it couldn’t identify. So, DeepSeek was not the only system involved.
CrowdStrike identified compromises at two pharmaceutical business in the US and unauthorized access to a Greek government entity, where agents forged an administrator token using authentication keys that appeared not to have been rotated since 2022, then read mailboxes and reached the internal network.
The VAPOR PANDA hackers also used AI to identify Windows computers without cybersecurity software, helping them choose machines where their activity might escape detection.
The attackers deployed BLOODALCHEMY – a derivative of the ShadowPad backdoor – to keep access to compromised networks. In one breach, planning agents consumed approximately 1.4 billion input tokens, the units AI models used to handle information, which CrowStrike says implies far higher consumption across the entirety of the operation.
CrowdStrike names telecom operators in the US, Belgium, and the Philippines among the organizations hit, alongside 19 US businesses across the pharmaceutical, semiconductor, defense, nuclear, and financial sectors, and foreign ministries in Latin America, Europe, Asia, and the Middle East.
These details illustrate the operational scale behind the China cyber espionage threat, while leaving an important distinction between attempted attacks and successful breaches. More than 200 targets do not mean more than 200 victims suffered confirmed intrusions. CrowdStrike confirmed active intruder operations inside at least nine networks.
Assessing the state of China cyber operations therefore requires attention to what investigators actually observed, rather than treating every targeted organization as compromised.
The report adds evidence to concerns about China cyber espionage, but the supplied account identifies the group as Chinese-linked without establishing a specific government command structure.
Describing such activity as state sponsored cyber operations requires attribution evidence beyond the attackers’ language, location or choice of technology, and the distinction between a vendor’s actor profile and its incident findings is worth preserving.
When Chatbots Become Attack Tools
A Reuters report in September described Anthropic’s findings that criminals and suspected state-backed hackers increasingly used Claude to organize and execute attacks. That broader picture helps explain why China cyber operations cannot be assessed solely through individual malware samples or stolen passwords.
“The use of AI went beyond simple questions and responses from a chatbot but rather involved the use of multi-agent frameworks,” said Anthropic.
Its findings included suspected Russia-linked operations against Ukrainian government, military and diplomatic targets involving phishing, hotel Wi-Fi hijacking and WhatsApp takeovers. The comparison shows how state sponsored cyber operations may benefit when AI reduces the effort needed to coordinate complex activity.
Anthropic also accused seven China-based laboratories including Alibaba, Moonshot AI, DeepSeek, Zhipu, MiniMax, SenseTime, and Xiaomi, of attempts to extract Claude’s capabilities. Those allegations concern model copying and data use, a separate issue from the DeepSeek AI hack described in CrowdStrike’s account.
The named companies did not immediately respond to Reuters’ requests for comments. China’s foreign ministry said it opposed distortions and smears and maintained that AI should be developed for good. Any discussion of a China cyber espionage strategy must keep those two sets of allegations apart and attribute each clearly.
As China cyber espionage continues to attract scrutiny, the immediate concern is how quickly defenders can recognize intrusions across connected systems. The combination of automated searches and persistent access makes China cyber operations a concern for organizations holding sensitive records and research.
Saying China continues cyber espionage should not obscure how much of the work still falls to the investigators examining each incident.
For affected organizations, the priority remains identifying unauthorized access, protecting information and restoring control before attackers can turn a foothold into lasting damage.
Inside Telecom provides you with an extensive list of content covering all aspects of the tech industry. Keep an eye on our Cybersecurity sections to stay informed and up-to-date with our daily articles.
