How Chinese State-Affiliated Hackers Are Using DeepSeek to Scale Cyberattacks

TeamT5 says Chinese state-affiliated cyber groups have more than doubled their attack volume since incorporating DeepSeek and other open-source AI models into their operations. The models are being used to automate routine tasks and help develop more advanced malicious software, making existing campaigns faster and easier to scale. 13

The findings do not show that AI independently replaces experienced hackers. Instead, they show how inexpensive models and agent frameworks can automate parts of the offensive workflow—especially reconnaissance, exploit research and repeated attack attempts—while human operators still select objectives and provide direction. 115

Why DeepSeek is attractive to attackers

Researchers cited four main reasons for DeepSeek’s popularity among Chinese hackers:

• Performance: It is considered capable enough for coding and reasoning tasks used in cyber operations.
• Customisability: Open or more accessible models can be adapted and connected to attacker-controlled tools.
• Lower cost: Operating costs are an important consideration when an attacker wants to run repetitive tasks at scale. 16
• Fewer cyber-safety restrictions: TeamT5 and Unit 42 described DeepSeek as having comparatively weak safeguards for offensive cybersecurity requests. 315

That combination matters operationally. A model does not need to discover a novel vulnerability to be useful: it can help search exposed systems, modify public exploit code, interpret technical output and decide which routine step to try next.

How the models are being used

The reporting describes China-linked groups using DeepSeek, ChatGPT and Claude Code for reconnaissance, exploit creation or adaptation, automation and the development of malicious code. It also mentions lateral movement in attacks on foreign companies and institutions. 3

The available reporting generally describes the activity as involving state-affiliated or China-linked actors collectively. It does not reliably identify a specific named advanced persistent threat group behind every reported use of AI, so those examples should not be treated as evidence that all Chinese cyber groups use the same model or workflow. 13

Why Western AI tools were both useful and limiting

Commercial tools such as ChatGPT and Claude Code could assist with portions of a malicious workflow, but provider-side safety controls may refuse explicit requests to conduct offensive operations. In the Unit 42 case, the operator tested Western tools and found that their safeguards blocked the autonomous attack task; DeepSeek was then selected as the main reasoning model. 1415

This contrast is less about one model being universally more capable than another and more about how the model is deployed. DeepSeek was connected to an open-source framework without the same client-side restrictions, allowing it to operate inside a toolchain controlled by the attacker. 15

The Hermes Agent campaign against more than 460 systems

Palo Alto Networks’ Unit 42 separately documented activity by a Chinese-speaking actor using the aliases “knaithe” and “KnYuan.” The operator configured DeepSeek as the reasoning engine behind Hermes Agent, an open-source, terminal-capable agent framework. The setup could enumerate vulnerabilities, retrieve public exploit code and attempt exploitation with limited human supervision. 155

The agent targeted more than 460 internet-facing systems. Reporting on the wider campaign says at least three organizations were breached through exploitation of a Citrix NetScaler vulnerability. The figure of 460 refers to targets or attack attempts—not 460 successful compromises—and the operation combined autonomous and conventional activity. 4

That distinction is important. The case does not show DeepSeek breaking into hundreds of systems on its own. It shows an operator using an AI model to automate the repetitive middle of an attack: finding exposed targets, matching them to known vulnerabilities, obtaining public exploit material and trying the next candidate.

What the findings mean for defenders

The clearest risk is scale. When a low-cost model is connected to an agent framework with terminal access, tasks that once required sustained manual effort can be repeated across many internet-facing systems. AI can therefore lower the operational barrier to high-volume reconnaissance and exploitation. 1615

But the same case also highlights the limits of the technology. Successful compromise still depended on exposed services, known vulnerabilities and usable public exploit code. AI increased the speed and volume of attempts; it was not, by itself, the cause of every breach. 515

For defenders, the practical priority remains reducing that attack surface: patch internet-facing products, remove unnecessary exposure and monitor unusual automated reconnaissance and exploitation patterns. The broader lesson from TeamT5 and Unit 42 is that AI-assisted attacks are becoming more economical and repeatable—even when the underlying techniques are familiar.