Chinese Hackers Double Cyberattacks Using AI, Report Says

Chinese state-affiliated hacking groups have more than doubled the volume of their cyberattacks after integrating open-source artificial intelligence models, particularly DeepSeek, into their operations, according to research from Taiwanese threat intelligence firm TeamT5. The findings reveal how experienced hackers are leveraging relatively basic AI tools to scale their activities and target entities abroad.

TeamT5 researchers said they obtained scripts and logs showing that AI models have been adopted across multiple stages of an attack, from reconnaissance to generating exploit code. The firm’s chief analyst, Charles Li, stated that DeepSeek is the preferred tool for these groups because it is "relatively powerful with very low cyber guardrails." He noted that while Western models are highly sought after, their stricter safety measures require significantly more effort to bypass. Cost and permissiveness are key drivers, with more powerful domestic models like Moonshot’s Kimi K3 considered prohibitively expensive for hackers to run.

The research identified several specific campaigns. A group known as Grimfengxi used DeepSeek to create exploit codes. Another group, Huapi, used...