Vixen and Keyhole Panda: China-linked cyber operations

This case study was originally published in OpenAI’s June 2025⁠(opens in a new window) report.

Actor

We banned ChatGPT accounts associated with multiple threat actors that have been publicly attributed to the People’s Republic of China (PRC). These accounts used infrastructure related to threat groups known as KEYHOLE PANDA (AKA APT5)⁠(opens in a new window) and VIXEN PANDA (AKA APT15)⁠(opens in a new window).

Behavior

The threat actors engaged with our models in both Chinese and English. The activity we observed came from the same networks, but fell into separate subsets based on activity.

One subset used our models to assist with behaviors aligned with open-source research into various entities of interest and technical topics. For the model interactions that were technical in nature, the threat actors used our models to modify scripts or to troubleshoot system configurations. This activity included mention of reNgine, an automated reconnaissance framework for web applications, and Selenium automation, designed to bypass login mechanisms and capture authorization tokens.

Another subset appeared to be attempting to engage in development of support activities including Linux system administration, software development, and infrastructure setup. Their system administration work included advice on configured firewalls and nameservers, and building software packages for offline deployment. Their software development activity included web and Android app development, and both C-language and Golang software. Infrastructure setup included configuring VPNs, software installation, Docker container deployments, and local LLM deployments such as DeepSeek.

Completions

These threat actors generated content related to a number of topics:

Representative examples of these activities can be mapped to the LLM ATT&CK framework as follows: