Chinese State-Linked Hackers More Than Double Attack Volume Using DeepSeek AI
Summary
- • Chinese state-linked hacking groups more than doubled attack volume after integrating open-source AI models — primarily DeepSeek — per research by Taiwanese firm TeamT5 published August 24, 2026
- • DeepSeek is attackers' AI of choice due to low cyber guardrails, customizability, and low cost; TeamT5 chief analyst: 'relatively powerful with very low cyber guardrails'
- • AI models now deployed across the full attack chain: reconnaissance, exploit development, and malicious software creation
- • Separate Unit 42 report documents a non-state Chinese-speaking actor using DeepSeek autonomously via Hermes Agent framework — AI-driven attacks now active across both state and non-state threat actors
Details
Attack volume more than doubled after AI integration
Chinese state-linked hacking groups more than doubled their attack volume after integrating open-source AI models into operations, per TeamT5 research published August 24, 2026.
TeamT5 documents systematic AI integration in state ops
Taiwanese cybersecurity firm TeamT5 released research documenting the systematic integration of open-weight AI models into Chinese state-linked hacking operations across reconnaissance, exploit development, and malware creation.
DeepSeek chosen for low guardrails, not raw capability
TeamT5 chief analyst Charles Li: 'DeepSeek is the AI of choice for Chinese hackers because it's relatively powerful with very low cyber guardrails.' Performance, customizability, low cost, and lax safety measures are cited as key factors.
AI deployed across full cyberattack lifecycle
Open-source AI models are being used for reconnaissance (target identification, OSINT), exploit development (vulnerability research, code generation), and malicious software creation — covering multiple phases of the attack chain.
Kimi K3 not confirmed for state groups — too expensive
TeamT5 has not recorded use of Moonshot's Kimi K3 among tracked state-linked groups; researchers believe the model is too expensive for these actors, contrary to some initial headline characterizations.
Non-state actor ran fully autonomous AI attacks
A separate July 2026 Unit 42 (Palo Alto Networks) report documented a non-state Chinese-speaking actor (aliases knaithe/KnYuan) using DeepSeek via the Hermes Agent framework alongside Kimi and other models for fully autonomous cyberattack campaigns.
Open-weight design enables unrestricted customization
DeepSeek's open-weight architecture means threat actors can run and fine-tune it locally without safety filters, rate limits, or API monitoring that commercial providers impose — making it structurally more accessible to adversarial use than closed models.
Sources: Bloomberg (Mark Anderson, August 24, 2026); TeamT5 research; Business Times; The Straits Times; Unit 42/Palo Alto Networks (July 2026). Details compiled via Grok live web research.
What This Means
Chinese state-linked hackers integrating AI models and more than doubling attack volume is a concrete, measurable escalation in cyber threat activity directly attributable to the availability of open-weight AI. DeepSeek's deliberately minimal safety guardrails, low cost, and open customizability make it uniquely dangerous in adversarial hands in a way that closed, API-gated models are not — raising serious questions about the security externalities of releasing powerful open-weight models without safety restrictions. This research provides the clearest quantified evidence yet that open-weight AI is actively accelerating nation-state cyber operations at scale, not just theoretically enabling them. The parallel Unit 42 finding of fully autonomous AI-driven attacks from a non-state actor suggests the threat has already proliferated beyond state programs.
Sentiment
Mostly alarmed and concerned about open-weight AI enabling scaled nation-state cyber operations
“China-linked hackers used Claude Code and DeepSeek as a cyberattack AI team. DeepSeek planned exploits and adapted when attacks failed, Claude handled the operational layer - ran commands, maintained access, built phishing pages. The impact is scale - faster attacks on governments, cloud systems and finance, with stolen credentials, source code and citizen data.”
“Disturbing News. China's state hackers have reportedly doubled there attack volume by using Deepseek. The Chinese government employees a massive hacker army and it is used to aggressively attack critical infrastructure. The world is becoming an increasingly dangerous place”
“State-backed Chinese hacker groups doubled attack volumes using open-source DeepSeek models to automate malware development. Regulatory scrutiny on open-weight AI distribution is escalating quickly.”
“Chinese state hackers doubled attack volume after adopting DeepSeek for routine tasks. Problem: the AI succeeded at reconnaissance but failed at actual intrusions.”
Split
~75/25 alarmed/concerned vs nuanced/skeptical on actual effectiveness