Attacks by Chinese hackers using artificial intelligence have doubled

Increasing number of attacks reported by Chinese hackers using open artificial intelligence models such as DeepSeek Bloomberg. The number of attacks launched by Beijing-linked cyber groups has more than doubled since they began using artificial intelligence to develop sophisticated malware, according to Taiwanese research firm Team T5.

Photo credit: Sasun Bughdaryan/unsplash.com

The researchers noted that it has not yet been possible to identify the artificial intelligence model used by the hackers, although according to their information, the development of DeepSeek is popular in cybercriminal environments due to its high performance and customization capabilities, as well as lower security requirements.

While the U.S. is increasingly concerned about the autonomous capabilities of cutting-edge models from Anthropic and OpenAI after a series of hacks in test environments, Chinese hackers are using less advanced AI to expand their operations and conduct attacks despite the presence of more capable AI models in the country, including Moonshot’s Kimi K3.

“DeepSeek is the AI ​​model chosen by Chinese hackers because it is relatively powerful and has very low network restrictions,” – said Charles Li, Chief Analyst of Team T5. — The Western model is in great demand, but its restrictions are much more restrictive and require more effort to circumvent. “

According to Team T5, the Grimfengxi group used DeepSeek to create exploitable code. Another group of Huapi hackers used a Chinese artificial intelligence model (usually DeepSeek) to attack a Thai company’s email system. The third group of hackers, named Teleboyi, used the platform to collect 1,000 IP addresses from the Internet and map them to the company’s domain name.

In some cases, Chinese hackers have used American artificial intelligence models to carry out attacks. Cybersecurity firm CyCraft reported that ChatGPT was used in attacks against Western think tanks. After receiving a copy of the employee’s local signal database from the hacked computer, the hacker asked the chatbot for help in building a software module designed to decrypt the database.