State-Backed Hackers Use Google Gemini and DeepSeek for Cyberattacks
According to a Google report, hacking groups from China, Iran, Russia, and North Korea are using AI chatbots like Google Gemini and the Chinese platform DeepSeek to assist with cyberattacks, including generating malicious code, phishing content, and researching targets. Security researchers found that DeepSeek exposed over 1 million user records and has weaker safety protections than Western competitors.
What happened
According to a Google report cited by The Wall Street Journal, hacking groups with known ties to China, Iran, Russia, and North Korea are leveraging AI chatbots like Google Gemini to assist with tasks such as writing malicious code and researching potential attack targets. Over 20 China-linked and 10 Iran-linked groups have been detected.
Iranian groups used Gemini to generate phishing content in English, Hebrew, and Farsi. China-linked groups used the chatbot for tactical research into technical concepts like data exfiltration and privilege escalation. North Korean hackers used it to draft cover letters for remote technology jobs.
Security researchers at Wiz discovered that DeepSeek left a critical database exposed online, leaking over 1 million records, including user prompts, system logs, and API authentication tokens. Testing of 50 well-known jailbreaks against DeepSeek's chatbot found lagging safety protections compared to Western competitors.
Reported impact
Hacking groups are using AI technologies as a productivity tool to enhance their cyber capabilities, according to The Wall Street Journal report citing Google. These groups are using the platforms primarily for efficiency rather than developing sophisticated and novel hacking techniques.
Google threat intelligence vice president Sandra Joyce stated that AI still remains far more beneficial for cybersecurity defenders than for attackers.
Index analysis
Experts have warned that these AI technologies could significantly transform cyber warfare. The emergence of DeepSeek has alarmed the US technology and intelligence sectors by demonstrating advanced capabilities at a fraction of traditional development costs.
Governance controls
DeepSeek's privacy policy confirms that it stores user data on servers in China. The platform's safety protections are described as lagging compared to Western AI competitors.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.