Chinese hacking groups are actively using the Chinese artificial intelligence (AI) model "DeepSeek" to attack overseas targets, according to an analysis.
According to the "2025 Asia-Pacific advanced persistent threat (APT) trends report" released by Taiwan cybersecurity research institute TeamT5 on the 24th (local time), Chinese hackers are expanding the scale of attacks by using open-source AI models, including DeepSeek.
In particular, hacking groups linked to the Chinese government have more than doubled the number of attacks as they delegate simple repetitive tasks to AI and begin using AI to develop more sophisticated malicious software.
TeamT5 said it cannot identify the AI model used in hacking every time, but assessed that DeepSeek is widely used among Chinese hackers based on its high performance and customization features. It noted that skilled Chinese hackers are expanding the scale of attacks and searching for new infiltration paths by using even relatively lower-performing AI models.
China has models with better performance than DeepSeek, including Moonshot AI's "Kimi K3," but analysts said hackers are focusing on the fact that DeepSeek's cybersecurity barriers are relatively lax and its operating expense is low. No hacking cases using Kimi K3 have been confirmed yet, and TeamT5 presumed it is due to the high operating expense.
Charles Li, a senior analyst at TeamT5, told Bloomberg, "DeepSeek is relatively high-performing, yet its cybersecurity mechanisms to block malicious use are very lax, so Chinese hackers prefer it," adding, "Demand for Western AI models is also high, but their safeguards are much stricter, and it takes more effort to circumvent them."
Open-source AI models, including DeepSeek, were found to be used at multiple stages of cyberattacks, such as target reconnaissance and the creation of vulnerability exploitation tools.
The Chinese hacking group "Grimfengxi" created attack code using DeepSeek. "Huapi" used a Chinese AI model believed to be DeepSeek to attack the email systems of Taiwanese corporations. "Teleboyi" also used DeepSeek to collect about 1,000 IP addresses from the internet and identify the domains of specific corporations.