Artificial Intelligence (AI) is now being increasingly utilized to execute cyberattacks on a massive scale. Hacking groups associated with China are reportedly using various AI tools, including DeepSeek, to enhance their operations. With the assistance of AI, these groups have managed to more than double the frequency of their cyberattacks. This significant finding has been brought to light by Team5, a prominent cybersecurity research firm based in Taiwan. Hackers are leveraging AI to develop malicious software and accelerate tasks related to hacking activities.
Why DeepSeek is Becoming a Favorite Among Hackers
According to a report by Bloomberg, which cites findings from the Taiwanese cybersecurity research firm Team5, DeepSeek has become particularly popular among Chinese hackers. The reasons for its popularity include its low cost, high capability, and relatively fewer restrictions on requests related to cybersecurity, while charles Li, the chief analyst at Team5, noted that while Western AI models are also favored by hackers, they tend to have much stricter security protocols and restrictions. The research also uncovered scripts and logs related to the use of AI during operations conducted by hackers linked to the Chinese government.
Diverse Methods of AI Utilization in Cyberattacks
The report claims that researchers have identified the use of AI in the activities of several Chinese hacking groups. A group named Grimfengshi allegedly used DeepSeek to generate exploit code. Meanwhile, another group called Huapi reportedly targeted the email system of a Taiwanese company using DeepSeek. The Teleboyi group is said to have used AI to gather 1000 IP addresses available on the internet and create a map of a company's domain. These instances demonstrate that AI is being employed across various stages of cyberattacks, from reconnaissance to execution.
Exploitation of ChatGPT and Claude
According to the report, Chinese hackers have also utilized American AI tools. The cybersecurity company Cycraft found evidence of ChatGPT being used during an attack on a Western think tank by a hacking software firm. Hackers allegedly sought help from the chatbot to develop software capable of decrypting data stolen from a compromised computer belonging to an employee. Also, Team5 mentioned the use of Anthropic's Claude code by a group named Slime22 after they breached a technology company in Taiwan. Following these incidents, Anthropic has reportedly blocked its services for companies controlled by China.