# China-Linked Hackers Used DeepSeek AI Against 200+ Organizations

- URL: https://usa-24.com/deepseek-ai-hacking-campaign-china/
- Publisher: USA 24
- Section: Artificial Intelligence (AI)
- Published: 2026-10-30T12:25:22.156Z
- Updated: 2026-10-30T12:25:22.164Z
- Topics: DeepSeek, CrowdStrike, AI Security, China Cyber Espionage, AI Agents

> CrowdStrike says a China-nexus group ran an AI agent framework, mostly powered by DeepSeek, against more than 200 organizations, including government ministries.

## Key takeaways

- CrowdStrike says the VAPOR PANDA campaign began on October 17, 2026, ran for 11 days and reached at least 14 countries.
- Intrusions were confirmed at nine organizations, where attackers installed the BLOODALCHEMY backdoor and moved into credential spraying and network scanning.
- The ARTEX framework ran mostly on DeepSeek, supplemented by a second subscription-based commercial model that CrowdStrike has not identified.
- At least 12 more organizations faced password spraying or credential scanning attempts.
- Reported government targets include two Latin American foreign ministries and a Middle Eastern interior ministry, while claims of US victims remain unconfirmed.

## What CrowdStrike found in the DeepSeek AI hacking campaign

Chinese state-linked hackers ran an AI agent framework, mostly powered by DeepSeek, against more than 200 organizations in 11 days, according to CrowdStrike. The security firm published its findings on October 29, 2026, and confirmed intrusions at nine of the targets. Public cases of a state-linked group running AI agents at this scale are rare, and this one puts a Chinese-developed open model at the center of an espionage operation.

The DeepSeek AI hacking campaign began on October 17, according to [Unite.ai's summary of the CrowdStrike report](https://www.unite.ai/china-nexus-vapor-panda-breached-nine-of-200-plus-targets-with-ai-agents/). CrowdStrike tracks the group as VAPOR PANDA and says the activity reached at least 14 countries. The firm described its scope as “more than 200 distinct organizations worldwide,” a line that [FourWeekMBA](https://fourweekmba.com/ai-china-linked-hackers-ran-deepseek-ai-agents-at-200-targets/) attributed to CrowdStrike's October 29 blog post.

The number that matters most for defenders is nine. CrowdStrike said it “confirmed post-exploitation activity at nine organizations,” which means attackers got inside those networks. The remaining organizations were targeted, and at least 12 more faced password spraying or credential scanning attempts. Some outlets describe the nine as “at least nine,” so the count could still change as more detail emerges.

## How the ARTEX agent framework worked

CrowdStrike calls the tool ARTEX. According to [ShiftDelete's account of the report](https://en.shiftdelete.net/vapor-panda-artex-ai/), it uses a main agent that delegates work to planner and worker agents. All of them share a common map of findings and goals, so each step can build on what the system already knows.

A human operator still played a role. The operator typed instructions in Chinese at key decision points, which means the software handled much of the routine work while a person chose the direction. That split between automation and human steering is what separates ARTEX from a simple script.

On the model side, ARTEX ran primarily on DeepSeek. [Unite.ai](https://www.unite.ai/china-nexus-vapor-panda-breached-nine-of-200-plus-targets-with-ai-agents/) reports that a second, subscription-based commercial LLM supplemented it, but CrowdStrike could not identify that model. The gap matters. Commercial model providers can sometimes see abusive activity on their own platforms and cut off accounts, but the reporting says nothing about whether that happened here.

## Which organizations were hit and what the intrusions looked like

The campaign's footprint comes down to a handful of figures.

| Measure | Reported figure | Detail |
|---|---|---|
| Organizations targeted | More than 200 | Across at least 14 countries |
| Confirmed post-exploitation | Nine | BLOODALCHEMY backdoor, credential spraying, network scanning |
| Password spraying or scanning | At least 12 more | Attempts, not confirmed intrusions |
| Campaign window | 11 days | Began October 17, 2026 |

In the nine organizations with confirmed activity, the attackers installed the BLOODALCHEMY backdoor and moved into credential spraying and network scanning, according to [Unite.ai](https://www.unite.ai/china-nexus-vapor-panda-breached-nine-of-200-plus-targets-with-ai-agents/) and [ShiftDelete](https://en.shiftdelete.net/vapor-panda-artex-ai/). ShiftDelete notes the backdoor was first documented in 2023, so teams that tracked it earlier may already have detection rules to run against their logs.

The government targets are the most sensitive detail. According to ShiftDelete's account of CrowdStrike's findings, the group extensively breached the foreign ministries of two Latin American countries and compromised a Middle Eastern interior ministry. In one European country, it targeted the foreign ministry, the presidency and the prime minister's office.

The reporting is thin on U.S. victims. [HNGN](https://www.hngn.com/articles/273633/20261029/china-linked-hackers-used-deepseek-ai-against-200-organizations.htm) said two of the compromised organizations were U.S. entities, but the sentence in that article is truncated, and a second outlet has not confirmed the claim. Treat it as unverified until CrowdStrike's advisory or a federal statement addresses it.

## Is DeepSeek safe to use after this campaign

The reporting does not describe a vulnerability in DeepSeek's software. What it describes is a widely available model serving as the engine of an intrusion campaign, which is a different problem. Taiwanese security firm TeamT5 has said state-affiliated Chinese groups more than doubled their attack volume after they began assigning routine work and malware development to AI. According to [Implicator's report](https://www.implicator.ai/chinese-hackers-double-attack-volume-deepseek/), TeamT5 says DeepSeek is favored for its low running cost and weaker guardrails.

The open nature of the model is the harder part. DeepSeek models can be downloaded and run locally, outside any provider's oversight, which makes it harder for any single company to cut off misuse. A person running a model on their own hardware does not face whatever controls a hosted service might apply.

DeepSeek has not publicly responded to the CrowdStrike findings. Beijing has routinely denied involvement in cyberespionage, according to [HNGN](https://www.hngn.com/articles/273633/20261029/china-linked-hackers-used-deepseek-ai-against-200-organizations.htm), and attribution to the Chinese state rests on CrowdStrike's assessment. For most users, the practical risk lies less in chatting with the model and more in giving it tools that can reach files, networks and credentials.

## How this compares with earlier AI-assisted attacks

The closest precedent is a September case that [Forbes](https://www.forbes.com/sites/thomasbrewster/2026/09/22/huge-cyberattack-uses-anthropic-and-deepseek-ai-to-target-100-companies/) reported in detail. A Chinese-speaking hacker combined DeepSeek, Kimi and an older Claude Opus model through open-source orchestrators called Cairn and Hermes. Forbes reported that the operation cost about $8,000 and targeted up to 100 companies.

The structure separates the two cases. The September attacker worked as a lone operator, while ARTEX describes a state-linked group with a planner-worker design and human steering. The VAPOR PANDA campaign also reached more organizations, with 200-plus targets and confirmed intrusions at nine.

The cost comparison deserves attention. If a campaign of this reach can be assembled for a few thousand dollars in compute and subscriptions, the barrier to entry falls sharply, and smaller criminal crews could copy the approach. The VAPOR PANDA reporting does not put a price on its campaign, so that comparison is an inference, not a finding.

This campaign is also separate from the China-linked VMware ESXi zero-day that USA 24 has covered. That involved a different group and a different flaw, so the two should not be merged.

## What security teams and developers should do now

Most of the steps are routine, which is part of the lesson. Start with these:

- Inventory AI agents. Confirm whether your organization runs agents, including tools built on DeepSeek models, that can reach networks or hold credentials.
- Review permissions. Remove broad system access from agents and check what third-party tools can read and write.
- Confirm logging. Make sure every agent action is logged and reviewable, so you can reconstruct what an agent did and when.
- Enforce MFA. Require multifactor authentication on remote and privileged accounts, since credential spraying was among the observed behaviors.
- Rotate exposed secrets. Replace API keys and passwords that agents or integrations could have seen.
- Watch for authentication bursts. Alert on unusual spikes in login attempts, the behavior CrowdStrike says it observed.
- Check the advisory. Review CrowdStrike's report for indicators of compromise, including BLOODALCHEMY, and search historical logs for matches.

Individual users and developers have a shorter list. If you use DeepSeek through a third-party app, check what that app can access before granting permissions. If you run a model locally, treat it like any other software you execute, with tight limits on network and file access.

## What to watch next

Three questions will shape how large this story becomes. The first is whether CrowdStrike names the second commercial model. The second is whether a U.S. organization is confirmed as a victim, which would bring the case squarely under federal cyber defense priorities. The third is whether DeepSeek changes its safeguards or responds publicly.

The case also lands in a policy debate that is already heating up. AI regulation has become a midterm issue, as [USA 24 reported](https://usa-24.com/ai-regulation-midterms-voter-backlash/), and federal buyers are already choosing among AI models, including a GSA offer of Claude at 40% off that [USA 24 covered](https://usa-24.com/anthropic-gsa-deal-claude-discount/). A documented state-linked campaign built on an open model gives lawmakers a concrete example to point to, whichever side of the debate they take.

## Frequently asked questions

### Is DeepSeek safe to use?

The reporting on this campaign does not identify a flaw in DeepSeek's software, but it shows the model can serve as the engine of an intrusion campaign. For most people, the bigger risk comes from giving any AI model tools that can reach networks, files or credentials. DeepSeek has not publicly responded to CrowdStrike's findings.

### What is the VAPOR PANDA hacking group?

VAPOR PANDA is the name CrowdStrike uses for a China-nexus group that ran the ARTEX AI agent framework against more than 200 organizations from October 17, 2026, over 11 days. CrowdStrike confirmed intrusions at nine organizations. Beijing has routinely denied involvement in cyberespionage, and attribution rests on CrowdStrike's assessment.

### What is the BLOODALCHEMY backdoor?

BLOODALCHEMY is the backdoor the attackers installed at nine organizations where CrowdStrike confirmed post-exploitation activity. ShiftDelete reports it was first documented in 2023. Security teams should check CrowdStrike's advisory for indicators of compromise and search historical logs for matches.

### Were any US organizations hacked in this campaign?

HNGN reported that two compromised organizations were U.S. entities, but the sentence in that article is truncated and a second outlet has not confirmed it. The reporting does not verify any U.S. victims, so the claim should be treated as unconfirmed for now.

## Sources

1. [China-Nexus VAPOR PANDA Breached Nine of 200-Plus Targets With AI Agents](https://www.unite.ai/china-nexus-vapor-panda-breached-nine-of-200-plus-targets-with-ai-agents/)
2. [China-Linked Hackers Ran DeepSeek AI Agents at 200+ Targets — FourWeekMBA](https://fourweekmba.com/ai-china-linked-hackers-ran-deepseek-ai-agents-at-200-targets/)
3. [China-Linked Hackers Used DeepSeek AI Against 200 Organizations — HNGN](https://www.hngn.com/articles/273633/20261029/china-linked-hackers-used-deepseek-ai-against-200-organizations.htm)
4. [Vapor Panda Hackers Used AI Agents to Target 200+ Organizations — ShiftDelete](https://en.shiftdelete.net/vapor-panda-artex-ai/)
5. [Chinese Hackers Double Attack Volume Using DeepSeek AI — Implicator](https://www.implicator.ai/chinese-hackers-double-attack-volume-deepseek/)
6. [A Chinese Hacker Used AI To Attack 100+ Companies In One Of Largest AI Hacks Yet — Forbes](https://www.forbes.com/sites/thomasbrewster/2026/09/22/huge-cyberattack-uses-anthropic-and-deepseek-ai-to-target-100-companies/)