# AI agents scale and speed up Chinese-linked attacks

DevFeed: [AI agents scale and speed up Chinese-linked attacks](<https://devfeed.tech/articles/ai-agents-scale-and-speed-up-chinese-linked-attacks-114103.md>)

Original publisher: [Read original article](<https://www.helpnetsecurity.com/2026/11/03/ai-powered-cyberattacks-artex-cyberstrikeai/>)

Author: Zeljka Zorz

Published: 2026-11-03T12:31:59Z

Content type: news

Language: en

Sources: [Help Net Security](<https://devfeed.tech/sources/help-net-security.md>)

Topics: [ai-assisted attacks](<https://devfeed.tech/topics/ai-assisted-attacks.md>), [Cybersecurity](<https://devfeed.tech/topics/cybersecurity.md>), [Large Language Model](<https://devfeed.tech/topics/llm.md>), [Multi Agent Systems](<https://devfeed.tech/topics/multi-agent-systems.md>), [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>)

Tags: [africa](<https://devfeed.tech/tags/africa.md>), [agentic-ai](<https://devfeed.tech/tags/agentic-ai.md>), [agents](<https://devfeed.tech/tags/agents.md>), [ai](<https://devfeed.tech/tags/ai.md>), [ai-agents](<https://devfeed.tech/tags/ai-agents.md>), [attack-tools](<https://devfeed.tech/tags/attack-tools.md>), [attacks](<https://devfeed.tech/tags/attacks.md>), [campaign](<https://devfeed.tech/tags/campaign.md>), [china](<https://devfeed.tech/tags/china.md>), [commands](<https://devfeed.tech/tags/commands.md>), [crowdstrike](<https://devfeed.tech/tags/crowdstrike.md>), [cyber-espionage](<https://devfeed.tech/tags/cyber-espionage.md>), [days](<https://devfeed.tech/tags/days.md>), [don-t-miss](<https://devfeed.tech/tags/don-t-miss.md>), [educational](<https://devfeed.tech/tags/educational.md>), [espionage](<https://devfeed.tech/tags/espionage.md>), [hot-stuff](<https://devfeed.tech/tags/hot-stuff.md>), [institutions](<https://devfeed.tech/tags/institutions.md>), [kaspersky](<https://devfeed.tech/tags/kaspersky.md>), [language-model](<https://devfeed.tech/tags/language-model.md>), [large-language-model](<https://devfeed.tech/tags/large-language-model.md>), [latin-america](<https://devfeed.tech/tags/latin-america.md>), [llm](<https://devfeed.tech/tags/llm.md>), [llms](<https://devfeed.tech/tags/llms.md>), [news](<https://devfeed.tech/tags/news.md>), [scale](<https://devfeed.tech/tags/scale.md>), [speed](<https://devfeed.tech/tags/speed.md>)

## AI overview

Two separate Chinese-linked campaigns used LLM agents to direct familiar intrusion techniques at greater speed and scale. CrowdStrike says Vapor Panda used ARTEX, mainly with DeepSeek, to target organizations in at least 14 countries over 11 days; its agents planned through shared state, while a human operator supplied instructions at decision points. CrowdStrike confirmed post-exploitation activity at nine organizations and password spraying at at least 12 others. Kaspersky describes a smaller campaign against educational institutions using CyberStrikeAI: its LLM ran on the attackers' C2 server and generated commands for a non-AI implant to execute. After initial manual access and reconnaissance, the operation reached domain admin accounts within three to four days. The article says the compromised hosts underwent familiar actions; the main change was speed and ease of execution. CrowdStrike advises rotating exposed credentials, enforcing SAML signature validation and IMDSv2, hunting for ARTEX markers, patching internet-facing appliances and deploying EDR throughout the environment.

## Source excerpt

A China-nexus espionage group used AI agents to attack more than 200 organizations in 11 days, CrowdStrike said last week. On Monday, Kaspersky published details of a separate campaign against educational institutions in Africa and Latin America, mounted by Chinese-speaking operators. Though the campaigns don't appear to be connected, they are executed the same way: a human picks the targets and sets the goals, and a large language model (LLM) decides which commands to run ... More -> The post AI agents scale and speed up Chinese-linked attacks appeared first on Help Net Security.