Chinese hackers use DeepSeek AI to boost attacks

Chinese state-affiliated cyber groups have significantly increased their attack volume following the integration of DeepSeek and other open-source AI models into their operations, according to TeamT5, a Taiwanese research firm. These hackers are leveraging AI to manage routine tasks and develop advanced malicious software. DeepSeek's popularity among Chinese hackers stems from its high performance and customization capabilities, although it's not always possible to determine which specific AI model was employed in each attack.

Charles Li, chief analyst at TeamT5, explained that DeepSeek is favored due to its powerful yet relatively weak cybersecurity barriers and low operational costs, in contrast to Western models that have more stringent guardrails and higher costs. While other Chinese models, such as Moonshot's Kimi K3, are more potent, they are beyond the financial reach of most hackers.

TeamT5 has identified Chinese government-affiliated hackers using DeepSeek for various stages of their attacks, including reconnaissance and exploiting vulnerabilities. For instance, the group Grimfengxi utilized DeepSeek to generate exploit codes, while Huapi employed a Chinese AI model, likely DeepSeek, to infiltrate a Taiwanese company's email system.

Another group, Teleboyi, used DeepSeek to gather 1,000 IP addresses from the internet and map company domains.