China’s hackers use DeepSeek for attacks, researchers say

Chinese state-affiliated cyber groups have significantly escalated their attack capabilities by adopting open-source AI models, particularly DeepSeek. TeamT5 reports a doubling of attacks, with AI assisting in tasks from reconnaissance to exploit code generation. DeepSeek's appeal to hackers stems from its balance of performance, customizability, and low operational cost, rather than being the most powerful model available. This points to a pragmatic approach by threat actors in Asia, prioritizing accessible and effective tools over cutting-edge but potentially more restricted or expensive alternatives like Kimi K3. The integration of AI into cyber operations by groups such as Grimfengxi and Huapi demonstrates a clear shift in tactics. While US national security officials worry about advanced models, observed activity shows even less capable AI is being effectively weaponized. The use of American AI, such as ChatGPT by a hacking software company to decrypt a Signal database, further complicates the cybersecurity landscape, highlighting the dual-use nature of AI tools and the challenges in enforcing ethical guidelines across borders. The thing to watch for Asian enterprises is the increasing sophistication and scale of attacks, even from less advanced AI. The low cost and accessibility of models like DeepSeek mean that the barrier to entry for developing advanced malicious software is dropping. Companies in the region must anticipate a higher volume of AI-assisted threats and strengthen their defenses against automated reconnaissance and exploit generation.