Worrying: Chinese hackers are using DeepSeek to scale up operations
What's the story
Chinese state-affiliated hackers have doubled their cyberattacks by using DeepSeek and other open-source artificial intelligence (AI) models, a report by Taiwanese research firm TeamT5 has revealed. The study highlights how these experienced hackers are leveraging basic AI tools to scale up their operations and target foreign entities. However, the specific AI model used in these attacks is not always identifiable.
AI tool
DeepSeek has low cybersecurity guardrails
DeepSeek is gaining traction among hackers due to its low cost and lax cybersecurity barriers.
Despite other more powerful models like Moonshot's Kimi K3, DeepSeek remains the AI of choice for Chinese hackers.
TeamT5's chief analyst Charles Li said, "DeepSeek is the AI of choice for Chinese hackers because it's relatively powerful with very low cyber guardrails."
Attack strategy
AI used at different stages of attack
TeamT5's research shows that DeepSeek and other open-source models have been used at different stages of an attack.
The AI has been employed for reconnaissance and generating ways to exploit vulnerabilities.
In recent months, the firm has obtained scripts and logs showing its use by Chinese government-affiliated hackers in their operations.
Cyber exploits
DeepSeek used by multiple hacking groups
Two hacking groups, Grimfengxi and Huapi, have been identified using DeepSeek.
The former used it to create exploit codes while the latter attacked a Taiwanese company's email system with a Chinese AI model likely to be DeepSeek.
Another group, Teleboyi, used the platform to collect 1,000 IP addresses from the internet and map a company's domains.
US involvement
ChatGPT was used to decrypt Signal database in a hack
In a surprising turn of events, a company selling hacking software used ChatGPT during an attack on a Western think tank.
The hackers consulted the chatbot to help build a software module designed to decrypt it after obtaining a copy of an employee's local Signal database from a compromised computer.
An OpenAI spokesperson said the company is committed to identifying and preventing attempts to abuse its models.