AI Tools Linked to Surge in Chinese State-Backed Cyberattacks, TeamT5 Warns

Taiwanese security firm TeamT5 warns that Chinese state-backed hacking groups have more than doubled their attacks since adopting AI for routine cyber tasks and malware development. The reported shift centers on tools that can help write exploit code, scan networks, and speed up reconnaissance.

The takeaway for defenders is direct: AI is not only a productivity tool for legitimate teams, but also a force multiplier for attackers. Security programs should assume faster probing, quicker tooling, and more frequent attempts from sophisticated groups.

According to the article, DeepSeek is especially popular among Chinese hackers, with TeamT5 chief analyst Charles Li saying it is “relatively powerful with very low cyber guardrails.” TeamT5 said the group Grimfengxi used DeepSeek to write exploit code, Huapi relied on a Chinese model likely to be DeepSeek, and Teleboyi used the platform to collect IP addresses and map domains.

Other tools also appeared in reported activity. CyCraft found evidence that ChatGPT was used to build a decryption module for a Signal database, while TeamT5 said Slime22 used Anthropic's Claude Code to move through the systems of a Taiwanese company.

The article also cites a UK AI Safety Institute study finding that the cyber capabilities of open models have jumped sharply. For fully autonomous attacks, those models still trail Western frontier models such as Claude Mythos by several months.

That gap matters because it may narrow over time. Organizations should treat AI-assisted cyber capability as a moving target, not a fixed threat category.

The reported uses point to practical areas of attention: exploit-code development, network scanning, IP collection, domain mapping, and movement through internal systems. Teams should review how quickly they detect and respond to these behaviors, especially when activity appears automated or unusually fast.

The clearest implication is that routine defensive hygiene becomes more urgent when attackers can automate routine offensive work. Exposure management, monitoring, and incident response workflows need to keep pace with faster AI-assisted operations.