-
Cybercriminals, who are linked to China, took advantage of ARTEX artificial intelligence to hack more than two hundred organizations in fourteen countries.
-
The automated agents searched for vulnerabilities, obtained passwords, circumvented protective measures, & carried out multiple attacks simultaneously.
-
Companies must ensure system patches, devices protection, and preparation of proper response plans against AI-based attacks.
Hackers with connections to China employed the ARTEX AI to target more than two hundred different organizations in fourteen distinct nations around the world. Security company CrowdStrike linked the campaign to a group it calls Vapor Panda.
The attack occurred on October 17 and lasted for eleven days. The campaign involved hacking governmental offices, telecommunications companies, organization in health, defense, finance, nuclear, plus computer chip manufacturing industries.
AI Helped Hackers Attack Many Targets
ARTEX AI is a tool that can run several automated tasks at once. Chinese developers first released it as an open-source project. However, its makers later restricted access after criminals used it in real attacks.
CrowdStrike said the campaign marks a major change in how China-linked groups use AI. Instead of using AI for one break-in, Vapor Panda used it to run several attacks at the same time.
The hackers relied on the capabilities of DeepSeek & an unnamed commercial linguistic solution to execute the attacks. They communicated with the system using the Chinese language. But they only engaged in the process when the AI positively required assistance regarding some decisions.
The AI systems conducted various operations such as finding vulnerabilities and weaknesses of various systems. Further, they also placed web shells on systems before they steal log in details. They also looked for new routes into networks when one method failed.
A web shell is a harmful file that gives attackers remote control over a website or server. It can help them stay inside a network and steal more information. In one attack, the agents used more than 1.4 billion input tokens. This shows how much automated work the system carried out during a single intrusion.
Governments and Major Firms Hit
CrowdStrike confirmed that the hackers broke into at least nine organizations. They also tested passwords and scanned for login details at 12 other high-value targets. The confirmed victims included telecom providers in the United States and Belgium. Government bodies in Greece, the Middle East and Latin America also faced attacks.
South Korean banks have also faced cyberattacks, including an AI-assisted campaign that targeted seven banks and exposed the personal information of 68,000 customers.
In the United States, the group targeted 19 organizations. These included companies in pharmaceuticals, semiconductors, defense, nuclear energy and finance. The hackers also attacked foreign ministries in several regions. CrowdStrike said they targeted government offices in Europe, Asia, Latin America and the Middle East.
In one Greek government attack, the AI agents used old authentication keys from a 2022 mail-server export. They created an administrator token and read email accounts. The agents made use of stolen VPN credentials to penetrate the internal network. This demonstrates that old, compromised data can help perpetrators even years after the breach.
Hackers Avoided Security Tools
The attackers also tried to avoid detection. They told the AI agents to skip Windows computers protected by CrowdStrike Falcon. Falcon is an endpoint protection tool that watches devices for harmful activity. The hackers instead focused on computers without this protection.
CrowdStrike said this shows the attackers built security avoidance into their AI workflow. They wanted the agents to find weak systems quickly and avoid stronger defenses.
Further, the group used BLOODALCHEMY in their operation, which is a backdoor that was initially disclosed in 2023. A backdoor allows hackers to gain access again after their initial intrusion.
CrowdStrike found BLOODALCHEMY on government systems in Latin America and the Middle East. The malware connected back to infrastructure linked to Vapor Panda.
Another ARTEX Attack Emerges
The Dutch Institute for Vulnerability Disclosure, or DIVD, also revealed that ARTEX AI attacked its network in September. The organization said the AI acted on its own during the breach.
According to DIVD, the attack from initial access to full system command took only 12 minutes. Moreover, the AI utilized two new unpatched zero-day vulnerabilities. The agent inspected a hacked mailbox, explored the internal system and collected login tokens. It also tried to reset passwords.
DIVD recorded more than 450,000 requests and 2,500 scripts during the attack. The organization described the activity as very loud and messy.
What this Means for Businesses
These types of attacks show how AI technology can help criminals accelerate their processes and reach out to a greater number of potential victims. As a result, rather than assaulting one business at a time, a team of few people can commit an automated attack against many targets.
Businesses should update their software quickly and remove old login details. They should also watch unusual activity, such as many failed password attempts or strange requests to email systems.
Companies should provide security for any devices and operating systems they have, not just the most visible computers. Hackers are constantly looking for vulnerable systems because they are easy to penetrate.
Finally, companies need to work on creating an incident response plan before something bad happens. The plan should contain information on who will be responsible and whom they will contact in case of the emergency.
