Targets included ministries, defence and semiconductor businesses and telecom operators. CrowdStrike reports post-intrusion activity at nine organisations; that does not mean all 200-plus targets were compromised.
Its analysis says agents mainly used DeepSeek and another unidentified commercial model under human direction. Model use does not establish provider involvement. The scale and attribution rest on CrowdStrike telemetry and analysis, without equivalent independent verification in the sources reviewed.