Chinese hackers use DeepSeek AI to boost attacks

Free Instant SEO Audit

Holographic robot analyzing DeepSeek code on screen

By NewSunSEO August 25, 2026

Chinese state-affiliated cyber groups have more than doubled their attack volume since incorporating DeepSeek and other open-weight artificial intelligence models into their operations, according to TeamT5, a Taiwanese threat intelligence firm. Researchers say the hackers now use AI to handle routine tasks, write malicious code, and automate stages from reconnaissance to exploitation.

What did TeamT5 find?

TeamT5 tracked a sharp rise in activity after DeepSeek and comparable open-weight models entered the toolkit of Chinese state-aligned operators. In recent months, researchers obtained scripts and logs showing these groups using the model across multiple phases of an operation, not just one isolated step.

Three named clusters stood out in the reporting:

Grimfengxi used DeepSeek to create exploit code.
Huapi, which researchers attributed to a Chinese AI model believed to be DeepSeek, targeted a Taiwanese company’s email system.
Teleboyi used the platform to collect 1,000 IP addresses from the public internet and map company domains for follow-on operations.

Why DeepSeek and not Western models?

TeamT5 chief analyst Charles Li said DeepSeek is the AI of choice for Chinese hackers because it combines strong performance with weak built-in guardrails. He added that Western models are highly capable but their safety filters are much stricter, which forces attackers to spend more time trying to bypass them.

Two other factors make DeepSeek attractive. The model can be customized locally once downloaded, and operating it costs far less than running comparable Chinese systems. TeamT5 noted that while alternatives such as Moonshot’s Kimi K3 are more powerful, they remain prohibitively expensive for criminal or espionage operations, and the firm has not recorded any incidents involving Kimi K3.

How are attackers using the models?

Researchers said DeepSeek and similar open-weight models are now used for:

Reconnaissance and target mapping, including bulk IP collection and domain enumeration.
Writing and refining exploit code.
Drafting phishing and social engineering lures.
Log analysis and operational triage during intrusions.

TeamT5 stressed that it is not always possible to attribute a specific AI model to a specific incident, since the outputs from one open-weight system can resemble another’s. The firm is relying on script artifacts, prompts, and behavioral patterns to make its assessments.

What does the broader trend look like?

The TeamT5 report fits a wider pattern documented across the security industry: open-weight large language models lower the barrier to entry for less-skilled operators and speed up routine work for advanced ones. Once a model is downloaded, attackers can strip out safety behavior, fine-tune the weights on malicious data, and run it on infrastructure they control, which removes the policy controls that hosted commercial APIs enforce.

The same models that write convincing phishing emails can also help with incident response, which is why security teams are deploying comparable tools on their own side.

What this means for defenders

For security teams, the practical takeaway is that AI-assisted attacks now arrive faster, in larger volume, and with cleaner code than before. Hardening still matters: prompt injection filters, egress monitoring for large model downloads, anomaly detection on identity systems, and tight email authentication all blunt the specific techniques TeamT5 documented. None of these controls are new, but the pace at which attackers iterate has changed, so detection and response playbooks need to assume that reconnaissance and exploitation can happen in the same afternoon.

FAQ

Are Chinese hackers really using DeepSeek to run cyberattacks?

Yes. Taiwanese research firm TeamT5 says Chinese state-affiliated cyber groups have adopted DeepSeek and other open-weight AI models across multiple stages of their operations, including reconnaissance and writing exploit code.

Why do hackers prefer DeepSeek over Western AI models?

TeamT5 chief analyst Charles Li says DeepSeek is relatively powerful and has low cyber guardrails, making it easier to repurpose for attacks. Western models have stricter safeguards that require more effort to bypass.

What specific hacker groups were linked to DeepSeek use?

TeamT5 identified Grimfengxi using DeepSeek to build exploit code, Huapi using a Chinese AI model, likely DeepSeek, to hit a Taiwanese company’s email system, and Teleboyi using the platform to scrape 1,000 IP addresses and map company domains.