---
title: Chinese Hacker Group Expands Global Cyber Attacks Using AI Agents
url: https://www.elseif.net/chinese-hacker-group-expands-global-cyber-attacks-using-ai-agents
published: 2026-11-06T15:03:20+00:00
language: en
section: Agents
source: https://www.dailysecu.com/news/articleView.html?idxno=209300
organizations: artex, crowdstrike, deepseek, panda, vapor
publisher: elseif
---

# Chinese Hacker Group Expands Global Cyber Attacks Using AI Agents

A Chinese-linked hacking group, 'VAPOR PANDA', has been identified as conducting widespread cyber espionage activities using large language models and AI agent frameworks. The attacks reportedly began on October 17, 2026, targeting at least 14 countries across Latin America, Europe, Asia, and the Middle East within just 11 days.

The attackers utilized the DeepSeek and ARTEK frameworks developed in China to target foreign ministries and key institutions. More than 200 organizations, including semiconductor, pharmaceutical, defense, and think tank entities in the United States, were among the victims. The methodology involved simultaneous attacks on multiple targets, with human operators intervening only at critical decision-making moments.

During the operation, the group directed agent workflows to locate Windows systems without CrowdStrike's Falcon sensors, aiming to evade security detection. Additionally, the attackers deployed the 'BLOODALCHEMY' backdoor targeting institutions in the Middle East and Latin America, disguising it as legitimate programs to load malicious DLLs and configuration files.

CrowdStrike stated that this incident demonstrates how even small attack groups can leverage AI-based frameworks to conduct large-scale attacks on multiple high-value targets simultaneously. Experts emphasize the importance of regularly changing service credentials and signing keys, minimizing command execution rights for cloud roles, and deploying EDR solutions throughout all environments, including internal servers not connected to the internet.