Chinese Hackers Double Attacks Using DeepSeek AI, Exploiting Weak Cyber Guardrails

China's hackers use DeepSeek for attacks, researchers say

Chinese hackers are ramping up attacks after integrating DeepSeek and other open-source artificial intelligence models into their operations, highlighting attackers' ability to leverage basic AI tools to hit targets abroad. State-affiliated cyber groups more than doubled the amount of attacks they carried out since they began delegating mundane tasks to AI and using it to develop advanced malicious software, according to TeamT5, a Taiwanese research firm. Researchers said it wasn't always possible to identify the AI model they used, but in general DeepSeek's offerings are popular with hackers in the country because of its high performance and ability to be customized. Anxieties among U.S. national security officials are mounting over the autonomous capabilities of advanced models from Anthropic and OpenAI after a series of high-profile incidents in which they managed to break out of testing environments.

DeepSeek AI Joins the Hacker Toolkit, Making Cyberattacks Faste

Hackers are using DeepSeek AI to speed up parts of cyberattacks, making some attacks easier and cheaper to carry out. DeepSeek is becoming more than an AI tool for coding, research and everyday tasks. Security experts found that hackers are also using the Chinese AI model to support cyberattacks. Its ability to write code, explain technical steps and automate parts of a task can make attacks quicker and easier to run. The growing concern is not that DeepSeek can suddenly carry out an entire cyberattack on its own. The bigger issue is how it can help attackers with jobs that once needed more time and skill. A recent report by TeamT5 brought this to light. Charles Li, chief analyst at Team T5, stated, "DeepSeek is the AI of choice for Chinese hackers because it's relatively powerful with very low cyber guardrails." Further, he added, "Western models are highly sought-after but their guardrails are much stricter and require a lot more effort to bypass." Hackers can use DeepSeek to break into someone's email system and analyze technical information to solve problems faster. This can lower the effort needed to launch certain attacks and on other parts of their campaigns.

Chinese hackers use DeepSeek AI to boost attacks By Investing.com

Investing.com -- Chinese state-affiliated cyber groups have more than doubled their attack volume since incorporating DeepSeek and other open-source artificial intelligence models into their operations, according to TeamT5, a Taiwanese research firm. The hackers have begun using AI to handle routine tasks and develop sophisticated malicious software. Researchers said DeepSeek's offerings are popular among Chinese hackers due to high performance and customization capabilities, though it wasn't always possible to identify which specific AI model was used in each attack. Get instant alerts on market-moving headlines on InvestingPro -- now 55% off. "DeepSeek is the AI of choice for Chinese hackers because it's relatively powerful with very low cyber guardrails," said Charles Li, chief analyst at Team T5. "Western models are highly sought-after but their guardrails are much more strict and require a lot more effort to bypass." Hackers are drawn to DeepSeek because of relatively weak cybersecurity barriers and low operational costs, researchers said. While other Chinese models like Moonshot's Kimi K3 are more powerful, they remain prohibitively expensive for hackers to operate. TeamT5 has not recorded any incidents involving Kimi K3. DeepSeek and other open-source models are now deployed across multiple attack stages, from reconnaissance to exploiting vulnerabilities. In recent months, researchers obtained scripts and logs showing Chinese government-affiliated hackers using the model throughout their operations. The group Grimfengxi used DeepSeek to create exploit codes. Another group, Huapi, used a Chinese AI model, likely DeepSeek, to attack a Taiwanese company's email system. A third group, Teleboyi, used the platform to collect 1,000 IP addresses from the internet and map company domains.