AI-assisted cyberespionage has expanded to simultaneous attacks against more than 200 organizations across 14 countries. The operation began October 17 and compromised at least nine organizations, while at least 12 other high-value targets faced password spraying and credential scans. Human operators directed ARTEX, DeepSeek, and another commercial model as agents handled reconnaissance, exploitation, web shells, credential theft, and alternate attack paths. The attackers skipped protected Windows hosts and focused on unprotected systems.
What Happened
A China-linked threat actor used multi-agent AI tools in attacks against more than 200 organizations across 14 countries. The operation began on October 17 and targeted government ministries, telecommunications providers, pharmaceutical companies, semiconductor organizations, defense and nuclear entities, and financial institutions. At least nine organizations were compromised. At least 12 other high-value targets experienced password spraying and credential-scanning activity.
The operators used ARTEX, an AI penetration-testing framework, along with DeepSeek and another unidentified commercial language model. Human operators issued instructions in Chinese and intervened when critical decisions were required. The agents performed reconnaissance, exploited weaknesses, deployed web shells, obtained credentials, and tried alternate attack paths when the first approach did not work.
Confirmed victims included telecommunications providers in the United States and Belgium, government organizations in Greece, the Middle East, and Latin America, and pharmaceutical companies in the United States. During an attack on a Greek government entity, the agents forged an administrator token and read mailboxes by using authentication keys found in a 2022 mail-server directory export.
The operators explicitly told the agents to avoid Windows systems protected by Falcon and focus on unprotected hosts. In one intrusion, the agents consumed more than 1.4 billion input tokens. The same framework was also linked to a separate incident in which an AI agent moved from initial access to root privileges in 12 minutes while generating more than 450,000 requests and 2,500 scripts. That activity was described as loud and messy despite its speed.
Why It Matters
The campaign demonstrates a shift from using AI for isolated tasks to coordinating multiple simultaneous intrusions under human direction. The agents did not remove people from the operation. Instead, they allowed human operators to assign reconnaissance, exploitation, credential collection, and route-finding work across many targets at once.
This changes the economics of broad cyberespionage. A single operation can test more organizations and pursue more alternative paths without requiring the same amount of manual work at every step. The agents can also move quickly after finding an opening, reducing the time defenders have to recognize and contain activity.
The decision to avoid protected Windows hosts is particularly important. It shows that inconsistent security coverage can guide automated attackers toward the weakest parts of an environment, even when other systems are well defended.
What to Watch
Further investigation may identify additional confirmed compromises among the more than 200 organizations that were targeted. Defenders should watch whether the same tools, infrastructure, or backdoor appear in other sectors or countries.
The balance between automation and human control also deserves attention. In this operation, people still made critical decisions, but agents performed much of the repeatable technical work. Organizations should expect future campaigns to continue testing multiple paths quickly, particularly where endpoint protection, internet-facing patching, or identity monitoring is inconsistent. High request volumes may expose some operations, but defenders should not assume every AI-assisted intrusion will remain equally noisy.
What Defenders Should Do
Coverage first: identify internet-facing, high-value, and administrative systems that lack endpoint protection or equivalent monitoring. Close those gaps before assuming that strong coverage on most systems is sufficient. Attackers in this campaign were deliberately directed toward unprotected hosts.
Identity controls: review old exports, archives, repositories, and configuration stores for authentication keys or tokens that remain usable. Monitor for password spraying, unusual token creation, forged administrative sessions, unexpected mailbox access, and credential use from unfamiliar systems.
Detection: correlate rapid sequences of reconnaissance, exploitation, web-shell deployment, credential access, and internal scanning. AI-driven activity may perform many tasks in parallel, so alerts that appear unrelated at the host level may be part of one coordinated operation.
Containment readiness: ensure responders can isolate an exposed host, revoke credentials, invalidate tokens, and search for alternate access paths quickly. Exercises should account for an attacker that changes direction when a preferred path is blocked. Protecting one platform should not leave adjacent systems as unmonitored alternatives.
The Larger Lesson
AI is not replacing the human operator in this campaign. It is multiplying the operator’s reach. People supplied objectives and intervened at important decision points, while agents performed high-volume technical work across many organizations.
The durable defensive lesson is consistency. Automated attackers can rapidly identify the one exposed server, unprotected endpoint, old authentication key, or weak identity path that sits outside normal coverage. Partial protection may slow an operation, but complete visibility and rapid containment are what prevent automation from turning small gaps into simultaneous compromises.