CrowdStrike: China-linked hackers used AI tool ARTEX with a DeepSeek LLM and another model to target 200+ organizations in 11 days, compromising at least nine

If you manage any online infrastructure, new AI-powered attacks can probe vulnerabilities over 200 times faster than before.

Chinese state-linked hackers, identified by CrowdStrike, have employed an artificial intelligence tool named ARTEX, powered by the DeepSeek Large Language Model (LLM) and another unnamed model, to conduct cyberattacks. This sophisticated operation targeted over 200 organizations globally within an 11-day period, successfully compromising at least nine. The rapid deployment and broad reach of this AI-assisted campaign highlight a significant escalation in the capabilities and efficiency of state-sponsored cyber threat actors. CrowdStrike's analysis indicates that AI is enabling threat groups to achieve a scale of attack previously unattainable with traditional human-driven methods.

This attack demonstrates a pivotal shift in cyber warfare, where AI tools like ARTEX and DeepSeek LLM are democratizing advanced hacking capabilities for state actors. The speed and scale of this operation, achieving over 200 compromises in less than two weeks, suggest a future where threat actors can rapidly iterate and deploy sophisticated attacks with reduced human oversight. This forces a re-evaluation of current defense strategies, which may be too slow to counter AI-driven campaigns that adapt and evolve in real-time.

The integration of LLMs into cyberattack toolkits signals a broader trend towards AI-augmented offensive operations across various threat landscapes. Organizations should anticipate an increase in highly targeted, rapid-response attacks that leverage AI for reconnaissance, exploit generation, and evasion techniques. The reliance on readily available AI models like DeepSeek by state-sponsored groups also raises concerns about the potential for widespread proliferation of these advanced offensive capabilities.