One operator, 200 targets: AI agents make espionage cheaper
On 29 October CrowdStrike documented a campaign by Vapor Panda, a China-linked group, that used an AI-agent system to attack more than 200 organisations in at least 14 countries.
For the first time it is documented in detail how a single operator uses AI agents to attack hundreds of targets in parallel, stepping in only at decision points. For defenders, the number of attacks rises without attackers needing more staff.
What happened
According to CrowdStrike the campaign began on 17 October; over an 11-day window a single controller called ARTEX directed attacks on more than 200 organisations. The main language model was DeepSeek, developed in China, alongside a second commercial model CrowdStrike could not identify. A lead agent assigned tasks to planning and worker agents, which tried several routes at once and switched when one failed. In a single intrusion the planning agents consumed about 1.4bn input tokens. Break-ins are confirmed at nine organisations, among them foreign ministries in Latin America, an interior ministry in the Middle East, telecoms providers in America, Belgium and the Philippines, and a Greek government body. The 19 American targets included financial firms. Germany is not mentioned in the report. Assessment: what is new is not the technique of individual steps but the scale. Work that once required a team is done by one operator with computing power.
What follows
CrowdStrike expects China-linked groups to keep adopting such agent systems over the next 12 months. For companies the calculation shifts: when attacks cost hardly any staff, mid-sized targets that used to fly under the radar become worthwhile. The recommended countermeasures are known but demanding: replace keys and service accounts after any suspicion, keep cloud permissions tight, close gaps where servers lack monitoring software. The report says the attackers looked specifically for Windows machines without protection software. Gaps in coverage thus become the first way in. For cyber insurers, how completely clients monitor their systems is likely to matter more.
What changes in practice
- IT departments
- The attackers sought machines without protection software. Full coverage, including internal servers, becomes a basic requirement.
- Companies
- When one operator attacks hundreds of targets at once, smaller firms become worthwhile. Replace credentials immediately after any suspicion.
- Financial sector
- The American targets included financial firms. The report names no confirmed break-ins there.
What to watch
- Whether German or EU authorities report cases involving agent tools
- DeepSeek's response to misuse of its model
- Warnings from Germany's BSI, the federal cyber-security agency, on automated attack campaigns
Sources
- CrowdStrike: VAPOR PANDA uses AI-driven ARTEX to grow global espionage campaign
- IT Brief UK: CrowdStrike uncovers China-linked AI cyber campaign
- Unite.AI: China-nexus VAPOR PANDA breached nine of 200-plus targets with AI agents