[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fm5ImXPCVpAre18hDkSqLxdseGtaJraImQPL565NJST4":3},{"article":4,"iocs":59,"watch_terms":63,"solutions":64,"lesson":155},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"7b338514-1682-4b90-a1f0-ec2d4666f5c9","AI agents scale and speed up Chinese-linked attacks","ai-agents-scale-and-speed-up-chinese-linked-attacks-1fba9f","A China-nexus espionage group used AI agents to attack more than 200 organizations in 11 days, CrowdStrike said last week. On Monday, Kaspersky published details of a separate campaign against educational institutions in Africa and Latin America, mounted by Chinese-speaking operators. Though the campaigns don’t appear to be connected, they are executed the same way: a human picks the targets and sets the goals, and a large language model (LLM) decides which commands to run … More → The post AI agents scale and speed up Chinese-linked attacks appeared first on Help Net Security.","China-nexus espionage groups are increasingly using AI agents and LLMs to automate and accelerate their attacks. CrowdStrike reported Vapor Panda used the ARTEX framework to target over 200 organizations in 11 days, employing AI for planning and command execution. Separately, Kaspersky detailed a campaign by Chinese-speaking operators using CyberStrikeAI against educational institutions, significantly speeding up post-compromise activities.","China-linked groups leverage AI agents for espionage, accelerating attacks on organizations globally.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F03\u002Fai-powered-cyberattacks-artex-cyberstrikeai\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2025\u002F08\u002F28142151\u002Fagentic-ai-1500.webp","2026-11-03T12:31:59+00:00","2026-11-03T13:00:03.695786+00:00",9,[17,20,22,25,27,30],{"name":18,"type":19},"Vapor Panda","threat_actor",{"name":21,"type":19},"Storm-0940",{"name":23,"type":24},"ARTEX","product",{"name":26,"type":24},"CyberStrikeAI",{"name":28,"type":29},"LLM","technology",{"name":31,"type":32},"CrowdStrike","vendor","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":33,"icon":35,"name":36,"slug":37},null,"Threat Intelligence","threat-intelligence",[39,44,49,54],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":50},{"id":51,"icon":35,"name":52,"slug":53},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":55},{"id":56,"icon":35,"name":57,"slug":58},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[60],{"type":58,"value":61,"context":62},"BloodAlchemy","Backdoor installed by Vapor Panda",[31,23,26],{"controls":65,"vendors":149},[66,94,123],{"slug":67,"name":68,"problem":69,"products":70},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[71,78,86],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":67,"product_name":75,"url":76,"description":77},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"slug":95,"name":96,"problem":97,"products":98},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":124,"name":125,"problem":126,"products":127},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[128,136,141],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":137,"product_name":138,"url":139,"description":140},"cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",[150],{"slug":151,"name":31,"logo_path":152,"roles":153},"crowdstrike","\u002Fvendor-logos\u002Fcrowdstrike.png",[154],"reported_by",{"slug":156,"title":157,"body":158,"framework_refs":159,"framework_notes":167},"ai-powered-chinese-espionage-campaigns-accelerate-attack-timelines-dramatically","AI-Powered Chinese Espionage Campaigns Accelerate Attack Timelines Dramatically","China-nexus threat actors are leveraging AI agents and large language models to automate reconnaissance, planning, and command execution, compressing what once took months into days. The ARTEX framework used by Vapor Panda allowed attackers to compromise over 200 organizations in just 11 days, a pace that overwhelms traditional human-speed defenses. CyberStrikeAI similarly accelerated post-compromise activities against educational institutions, where security resources are typically limited. This matters because defenders are still operating on human timelines while adversaries now operate at machine speed, fundamentally shifting the asymmetry of cyber conflict. Organizations must assume AI-assisted adversaries as the new baseline threat model and build detection and response capabilities that can match that tempo.",[160,161,162,163,164,165,166],"MITRE ATT&CK T1059: Command and Scripting Interpreter","CIS Control 17: Incident Response Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 SI-2: Flaw Remediation","NIS2 Article 21(2)(b)","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities",{"NIS2 Article 21(2)(b)":168,"NIST SP 800-53 SI-2: Flaw Remediation":169,"CIS Control 17: Incident Response Management":170,"MITRE ATT&CK T1059: Command and Scripting Interpreter":171,"CIS Control 14: Security Awareness and Skills Training":172,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":173,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":174},"NIS2 requires incident handling and monitoring capabilities sufficient to detect and respond to advanced attacks; the AI-accelerated pace of these campaigns demands the automated monitoring and response measures the article mandates.","AI agents can rapidly scan for and exploit unpatched vulnerabilities at scale; timely flaw remediation reduces the exploitable attack surface that automated frameworks depend on for initial and sustained access.","The machine-speed pace of AI-assisted attacks (200 orgs in 11 days) means traditional incident response timelines are completely inadequate; automated, pre-planned IR playbooks are essential to respond at the required speed.","AI agents like ARTEX and CyberStrikeAI rely heavily on automated command execution via scripting environments; controlling and monitoring interpreter usage is directly relevant to detecting and limiting these attacks.","Security teams at targeted organizations, particularly under-resourced educational institutions, need explicit training on recognizing AI-accelerated attack indicators that differ significantly from traditional human-paced intrusions.","Systematic vulnerability management limits the exploitable footholds that AI-driven frameworks like ARTEX use to rapidly pivot through hundreds of organizations in compressed timeframes.","AI-automated post-compromise tools depend on valid credentials for lateral movement; strong identity controls and MFA directly impede the automation chains used by these threat actors."]