Artificial intelligence is emerging as a powerful tool for cybercriminal groups and state-linked hacking operations, with China-linked groups reportedly turning to DeepSeek and other AI models to accelerate their attacks. According to research cited by Bloomberg, Taiwan-based cybersecurity firm TeamT5 has observed AI being used across multiple stages of cyber operations, with the frequency of attacks by some Chinese hacking groups reportedly more than doubling after the adoption of AI.
The findings highlight a growing cybersecurity challenge as hackers increasingly use generative AI not just for writing malicious code, but also for reconnaissance, vulnerability exploitation, data processing and other technical tasks.
Why DeepSeek Is Gaining Attention Among Hackers
According to the report, DeepSeek has become particularly popular among China-linked hacking groups. TeamT5 reportedly attributes its appeal to its relatively low cost, capabilities and fewer restrictions on certain cybersecurity-related requests compared with some Western AI models.
Charles Li, chief analyst at TeamT5, reportedly said Western AI models are also being used by hackers, but their stronger safety restrictions can make them less attractive for certain malicious activities.
Researchers reportedly found scripts and logs suggesting that AI tools were being incorporated directly into hacking operations linked to Chinese government-affiliated groups.
AI Used Across Different Stages of Cyberattacks
The research reportedly identified several examples of Chinese hacking groups using AI for different purposes.
The group GrimFengShi allegedly used DeepSeek to help generate exploit code. Another group, Huapi, reportedly used DeepSeek while targeting the email system of a Taiwanese company.
A group identified as Teleboyi allegedly used AI to collect around 1,000 IP addresses available online and map the digital infrastructure of a targeted company.
These cases suggest that AI is increasingly being integrated into multiple stages of cyberattacks, from reconnaissance and infrastructure mapping to vulnerability exploitation and technical development.
ChatGPT and Claude Also Reportedly Used
DeepSeek is not the only AI platform reportedly appearing in hacking operations.
According to the report, cybersecurity firm Sycraft found evidence that ChatGPT was used during an attack on a Western think tank. Hackers allegedly sought assistance from the chatbot to develop software capable of decrypting data stolen from a compromised employee computer.
TeamT5 also reportedly linked the Slime22 group to the use of Anthropic's Claude coding capabilities after the group breached a Taiwanese technology company.
Anthropic subsequently blocked its services for China-controlled companies, according to the report.
AI Could Lower the Barrier for Sophisticated Attacks
The growing use of AI by hacking groups could make sophisticated cyber operations faster and potentially more scalable. Tasks that previously required significant technical expertise can increasingly be assisted by AI tools, allowing attackers to automate portions of reconnaissance, coding and data analysis.
At the same time, the findings underscore the continuing challenge for AI companies to balance useful capabilities with safeguards against malicious use.
The reported activity also demonstrates that the AI race is extending beyond legitimate applications. As organisations deploy AI for business and productivity, threat actors are increasingly looking to the same technology to enhance their cyber operations.
𝐒𝐭𝐚𝐲 𝐢𝐧𝐟𝐨𝐫𝐦𝐞𝐝 𝐰𝐢𝐭𝐡 𝐨𝐮𝐫 𝐥𝐚𝐭𝐞𝐬𝐭 𝐮𝐩𝐝𝐚𝐭𝐞𝐬 𝐛𝐲 𝐣𝐨𝐢𝐧𝐢𝐧𝐠 𝐭𝐡𝐞 WhatsApp Channel now! 👈📲
𝑭𝒐𝒍𝒍𝒐𝒘 𝑶𝒖𝒓 𝑺𝒐𝒄𝒊𝒂𝒍 𝑴𝒆𝒅𝒊𝒂 𝑷𝒂𝒈𝒆𝐬 👉 Facebook, LinkedIn, Twitter, Instagram