CrowdStrike: China-linked hackers attacked more than 200 organizations in 11 days using AI

On October 30, 2026, CrowdStrike (a cybersecurity solutions provider) reported a campaign in which China-linked hackers attacked more than 200 organizations worldwide in 11 days. NBC News was the first to report this.

According to CrowdStrike, the attackers used AI-based tools, including the popular DeepSeek model. The targets were government agencies and commercial companies in various countries. The exact list of victims and the geography are not disclosed in the report.

The difference from previous campaigns is in scale and speed. Previously, such coverage required significantly more manual work: preparing phishing emails, reconnaissance of targets, selecting exploits, and coordinating actions. Here, according to CrowdStrike's assessment, some of these tasks were automated using AI. At the same time, the report does not provide data on which specific stages of the attack the model performed or by what percentage the share of manual labor decreased.

In practice, this means that defensive teams must proceed from the assumption that the speed of attack preparation is increasing. If previously a campaign against hundreds of targets took weeks or months of a group's work, now some of the routine can be shifted to a model. For organizations, this is primarily a matter of monitoring: phishing emails and login attempts generated automatically are harder to distinguish by style or grammar—typical signs of manual work.

What remains unknown: CrowdStrike does not specify which organizations were affected or in which countries, nor does it provide evidence of the group's connection to the Chinese state beyond its own attribution. There is no data in the report on whether there was damage—leaks, encryption, or downtime. It also does not disclose exactly how DeepSeek was used in the attacks: for generating text, writing code, or other tasks.