Plan ahead High Monitor
China-backed group used AI penetration tool against about 140 targets
CyberScoopCrowdStrike, DeepSeek · telecommunications, defence, pharmaceutical
What happened. CrowdStrike says the group Vapor Panda used the agentic AI penetration testing tool ARTEX, with DeepSeek, to compromise about 140 targets in 11 days. It targeted more than 200 organisations in at least 14 countries since 17 October.
Who is affected. Foreign ministries, defence and intelligence agencies, and 19 US organisations in pharmaceutical, semiconductor, defence, nuclear and financial sectors. Telecom providers in the US, Belgium and the Philippines.
What to do. Brief your security team on this campaign and review CrowdStrike's threat report for indicators and guidance relevant to your sector.
When to act. Plan ahead: review your exposure to the same entry point
Editor's reading
Fordetection engineerIT securityleadership
- Purdue level
- L5
- L4
Why: The report describes intrusions into organisations' networks from the internet, which sit at the enterprise edge (L5) and corporate IT (L4); it names no OT systems.
- Are you exposed?
Review internet-facing services and authentication logs for fast automated probing and compare findings against the indicators in CrowdStrike's report.
- If you cannot fix it yet
- Restrict internet-facing services to those you need and patch them first.
- Enforce multi-factor authentication on all remote-access paths into IT and OT networks.
- Watch for
- Rapid, repeated requests against internet-facing services, as often as every 10 seconds, from a single source.
- Several attack paths tried at once against the same host or account.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.