Chinese hackers using DeepSeek AI to escalate cyberattacks
Taiwanese cybersecurity researchers report that Chinese state-linked hacking groups have more than doubled their cyberattack volume since adopting DeepSeek and other AI tools to automate tasks and develop malware. The groups exploit DeepSeek's low cost and weak cybersecurity guardrails compared to Western AI models.
What happened
Chinese state-linked hacking groups have more than doubled the number of cyberattacks they carry out since using AI tools for developing malicious software and automating hacking tasks, according to TeamT5, a Taiwanese cybersecurity research firm.
Groups including Grimfengxi, Huapi and Teleboyi used DeepSeek to create exploit code, target email systems, and map company domains and internet-facing addresses. The hacking group Slime22 used Anthropic's Claude Code after gaining access to a Taiwanese technology company.
Reported impact
Chinese hackers have reportedly targeted foreign companies and institutions using AI-developed malware and reconnaissance tools.
DeepSeek is preferred by Chinese hackers because of its high performance, low cost, customisability and weak cybersecurity guardrails compared to Western AI models like OpenAI's ChatGPT and Anthropic's Claude.
Index analysis
According to TeamT5 chief analyst Charles Li, 'DeepSeek is the AI of choice for Chinese hackers because it's relatively powerful with very low cyber guardrails. Western models are highly sought after, but their guardrails are much stricter and require a lot more effort to bypass.'
Experienced Chinese hackers have demonstrated the ability to use lower-capability AI models like DeepSeek to scale attacks more effectively than more advanced Western models with stronger security restrictions.
Governance controls
Anthropic has blocked its services from Chinese-controlled companies in response to abuse of its Claude tools by the hacking group Slime22.
DeepSeek, China's embassy in Washington, and China's Ministry of Foreign Affairs did not respond to requests for comment on the allegations.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.