TeamT5 ties doubled Chinese state hacker attacks to DeepSeek

Chinese state-affiliated hacking groups have more than doubled their attack volume since delegating reconnaissance and malware development to open-source AI, according to Taiwanese threat-intelligence firm TeamT5, in research reported by Bloomberg.

The preferred tool is DeepSeek. "DeepSeek is the AI of choice for Chinese hackers because it's relatively powerful with very low cyber guardrails," Charles Li, TeamT5's chief analyst, told Bloomberg, adding that Western models are "highly sought-after but their guardrails are much more strict and require a lot more effort to bypass."

TeamT5 named three groups. Grimfengxi used DeepSeek to generate exploit code. Huapi used a Chinese AI model, likely DeepSeek, against a Taiwanese company's email system. Teleboyi used the platform to collect 1,000 IP addresses and map corporate domains.

Cost is the other half of the story. Moonshot's Kimi K3 is more capable but too expensive for these operators to run at hacker scale, and TeamT5 says it has documented no incidents involving it. The firm also flagged other reuse of commercial AI in Chinese operations, including a group it calls Slime22 using Anthropic's Claude to move laterally through a Taiwanese tech company's systems, and hackers turning to OpenAI's ChatGPT to help decrypt Signal databases.

The finding rests on a single source, TeamT5 says it wasn't always possible to identify which specific AI model was used in a given intrusion, and neither the affected Taiwanese company nor the DeepSeek versions are named. It lands alongside other Taiwan-China stories on our radar this week, including Taiwan's indictment of nine people over Nvidia B300 server smuggling.