Artificial intelligence is increasingly being harnessed to conduct large-scale cyber espionage operations, according to a recent exposure by cybersecurity firm CrowdStrike. The firm revealed that a China-linked hacker collective identified as “Vapor Panda” targeted more than 200 institutions spread across 14 nations using an AI-driven agentic framework. The extensive operation compromised numerous government departments and key ministries across multiple jurisdictions.
Strategic Sectors and Government Bodies Targeted
The organizations singled out by the campaign include government establishments, foreign ministries, and critical industrial entities. Corporate targets spanned vital sectors, notably defense contractors, semiconductor developers, pharmaceutical manufacturers, and telecommunications providers. The cyber activity reportedly commenced on October 17, initiating widespread surveillance efforts aimed at gathering valuable institutional data and compromising sensitive communication lines.
Investigators discovered that the intrusion campaign hit several high-profile political targets within Europe. Among those subjected to espionage attempts were the foreign affairs ministry of a European nation alongside executive offices associated with its president and prime minister.
Open-Source Framework and Multiple AI Models Deployed
To execute the complex surveillance blitz, the threat actors coupled an open-source agentic AI architecture known as Artex with cutting-edge machine learning models. The attackers utilized China’s DeepSeek model alongside another commercial AI tool to coordinate and automate their digital assaults. The integration of agentic frameworks provided the attackers with advanced automation capabilities to probe administrative networks and accelerate multiple phases of their cyber espionage operation.
The application of automated agentic workflows signifies an evolving approach by state-aligned hacking groups, allowing small units of operatives to orchestrate simultaneous intrusions across dozens of disparate foreign targets without needing to manually run individual technical actions at every stage.
Deployment of BloodAlchemie Backdoor and Credential Harvesting
According to findings detailed in CrowdStrike’s investigative report, the intruders established persistence within targeted networks by deploying a backdoor program called BloodAlchemie. Once this unauthorized foothold was secured, the operators conducted network reconnaissance to map internal environments and harvested critical login credentials from the compromised domains.
The security researchers also recorded deliberate attempts to harvest password and access details from at least 12 additional external organizations. The gathered login credentials allowed the cyber espionage operators to penetrate deeper into protected networks, facilitating continuous surveillance operations against political, diplomatic, and commercial institutions worldwide.
