EXPLORINEER
en

KR — 전자신문

China-linked hackers launch AI-driven attacks on over 200 organizations worldwide, targeting US chip and defense firms

Security1 min read

A China-linked hacking group used AI tools to attack more than 200 organizations around the world, including US chip and defense companies. CrowdStrike, a cybersecurity firm, reported the campaign in a threat analysis report.

What happened

CrowdStrike said a China-linked hacking group called VAPOR PANDA ran AI-driven cyberattacks on at least 14 countries over 11 days, starting on the 17th of last month. The attackers used a Chinese large language model (LLM) called DeepSeek and an AI-based intrusion tool called ARTEX. They split the work among several AI agents, which handled everything from finding weak spots to breaking in, scouting networks, and taking control of accounts.

Key numbers and facts

  • More than 200 organizations and companies were targeted.
  • At least 14 countries were hit in an 11-day campaign.
  • In the US, 19 companies in pharmaceuticals, chips, defense, nuclear power, and finance were targeted.
  • Telecom operators in the US, Belgium, and the Philippines were confirmed as breached.
  • At least 9 organizations had attackers gain access and install a backdoor called BLOODALCHEMY.

Background

ARTEX was first built as an open-source tool for penetration testing, which means testing a system by attacking it on purpose to find weak spots. Attackers have now turned it into a real hacking tool. The same tool was also used earlier in attacks on South Korean financial companies.

Why it matters

The attackers gave their commands to the AI in Chinese, and they stepped in at key moments to change direction. CrowdStrike warned that a small group of attackers can now hit many countries and organizations at once, and that these attacks are likely to grow.

What to watch

  • Whether more organizations report breaches linked to VAPOR PANDA.
  • How AI tool makers limit misuse of open-source hacking tools like ARTEX.
  • Whether governments respond to attacks on their ministries and telecom networks.

Glossary

CrowdStrike
A cybersecurity company that finds and reports hacking threats.
DeepSeek
A Chinese large language model, an AI system that understands and writes text.
ARTEX
An AI-based intrusion tool that was first made to find security weak spots in tests.
BLOODALCHEMY
A backdoor, a hidden entry point that lets attackers return to a computer without permission.

Same story, different eyes

Ad

Add 150 words. Learn 10 a day.

Dicter word books send only the words you learn to your review notes.

More in this topic

SecurityITmedia

Up to 77 Million Email Addresses Possibly Leaked in Arara Message Breach; Attackers Breached Client Company Servers

Paycloud Holdings said on November 2 that about 77 million email addresses may have been leaked or exposed in the unauthorized access to its subsidiary Arara's email delivery service "Arara Message," with up to about 380 contracted companies affected. Attackers reportedly entered contracted companies' systems via Arara Message servers between October 28 and 31, taking data from 97 servers, and were also found to have sent up to about 7.13 million phishing emails impersonating credit card companies. The service has been fully suspended since October 31, with no restart date set.

SecurityITmedia

Asoview Leaks Data of 15.82 Million Members, Including Last Login Dates and Facilities Used, Via Email Contractor Arara Unauthorized Access

Asoview announced on November 3 that unauthorized access to Arara's email delivery service, which it used to send member emails, led to the leak of 15,821,184 member records. The leaked data includes email addresses, names, last login dates, facility names, ticket purchase details, and other information, while passwords and credit card information were not leaked. Asoview has halted all email delivery through Arara's service and invalidated authentication credentials, and it plans to notify affected members individually after matching the leaked data.

SecurityITmedia

GMO Payment Gateway reports "unauthorized user activity" in payment support system; 69 Vpreca records leaked, 3 including security codes

GMO Payment Gateway said on November 2 that unauthorized user activity occurred on October 30 in its Issuing Support Service, which is provided to credit card companies, leaking information on 69 users of Life Card's Visa prepaid card "Vpreca." For three of these, the Vpreca card number, security code, expiration date and name may have been stolen, though Life Card has not confirmed any unauthorized use and closed those accounts on October 31.

SecurityTechCrunch

Researchers warned of North Korean hacking tactics years before record $6.3B Binance heist

Binance says North Korean hackers posed as recruiters and used a fake coding assignment over a months-long scheme to install malware on a software engineer's work laptop, which gave them a foothold to steal a record $6.3 billion in crypto. The company said its security tools did not detect the malware and that it has since improved its network security. Researchers and governments had warned for years about North Korean social engineering tactics targeting the crypto industry.