이미지: METAL LAB 생성
Summary
- Taiwanese security firm TeamT5 says attack volume from Chinese state-backed hacking groups has more than doubled since they began using AI for routine work and malware development
- Grimfengxi, Huapi, and Teleboyi used DeepSeek to write exploit code or gather IP addresses and domains, one group used ChatGPT to build a decryption module for a Signal database, and Slime22 used Claude Code to move laterally inside Taiwanese corporate systems
- A UK AI Safety Institute study found open models are rapidly closing the gap in cyber-offense capability, though for fully autonomous attacks they still lag top Western models like Claude Mysos by several months
- 발표 주체
- 대만 사이버보안업체 TeamT5 (블룸버그 보도)
- 핵심 주장
- AI 도입 이후 중국 국가배후 해킹조직 공격 건수 2배 이상 증가
- Grimfengxi
- 딥시크로 익스플로잇 코드 작성
- Huapi
- 딥시크로 추정되는 중국산 모델로 익스플로잇 코드 작성
- Teleboyi
- 딥시크로 IP 주소 수집·도메인 매핑
- ChatGPT 사례
- 보안업체 CyCraft, 시그널 DB 복호화 모듈 제작에 챗GPT 사용 정황 확인
- Slime22
- 앤스로픽 클로드 코드로 대만 기업 시스템 내부 이동
- 영국 AI안전연구소 조사
- 오픈 모델 사이버 능력 급상승, 완전 자율 공격은 클로드 미소스 등 서구 최상위 모델에 수개월 뒤처짐
Why attack volume more than doubled
The analysis from Taiwanese cybersecurity firm TeamT5, reported by Bloomberg, is straightforward. Once Chinese state-backed hacking groups started using AI for routine tasks and malware development, their attack volume more than doubled. TeamT5's chief analyst Charles Li pointed to DeepSeek as the reason, saying it's "relatively powerful with very low cyber guardrails."
DeepSeek is developed by a small research team in Hangzhou, China, backed by hedge fund money. It has managed to approach U.S. model performance at a fraction of the training cost, and crucially, it releases its full model weights openly. That means anyone can download it and run it on their own servers—an openness that cuts both ways: transparency for defenders, but an unguarded tool for attackers.
Different groups, different AI, different uses
TeamT5's tracked cases show each group has its own approach to using AI. Grimfengxi wrote exploit code directly with DeepSeek. Huapi used what's believed to be a Chinese-made model, likely DeepSeek, for the same purpose. Teleboyi leaned more toward reconnaissance work—collecting IP addresses and mapping domains—using DeepSeek for that.
It wasn't only Chinese models in play. Security firm CyCraft found evidence in one incident that ChatGPT was used to build a decryption module for a Signal messenger database. And a group known as Slime22 was found to have used Anthropic's coding tool, Claude Code, to move laterally through internal systems at a Taiwanese company.
| Hacking Group | AI Used | Confirmed Activity |
|---|---|---|
| Grimfengxi | DeepSeek | Writing exploit code |
| Huapi | Chinese-made model (likely DeepSeek) | Writing exploit code |
| Teleboyi | DeepSeek | IP collection, domain mapping |
| Unidentified (confirmed by CyCraft) | ChatGPT | Building Signal DB decryption module |
| Slime22 | Claude Code | Lateral movement inside Taiwanese corporate systems |
How far have open models caught up on cyber-offense?
A separate study by the UK AI Safety Institute puts numbers behind this trend. It found that open models' cyber-offense capabilities have jumped sharply in recent months. Still, when it comes to fully autonomous attacks—ones carried out start to finish without human intervention—they remain a few months behind top-tier Western models like Claude Mysos. In other words, as an assist tool where a human still drives the prompts, these models are already good enough for real-world use. The remaining gap is specifically in autonomy: the ability to make judgment calls and carry an attack through on its own.
Editor's take
What makes this notable is confirmation that DeepSeek's low cost and openness appeal just as much to state-backed hacking groups as they do to enterprise users. In our piece last month on the AI price war, we covered how companies were shifting to Chinese models to cut costs—this TeamT5 report shows that same low-cost, low-restriction structure is playing out just as clearly in the market for attack tools. A model with weak guardrails lowers the cost of adoption, but it lowers the cost of abuse right along with it.
Looking at this generationally, the shift is stark. State-backed hacking used to mean entire teams spending weeks hand-crafting exploits. Now a prompt can produce a draft of working code in minutes. Reconnaissance has changed the same way—IP scanning and domain mapping that once required people running scripts can now be handled conversationally, which means the same headcount can cover far more targets. That's probably the real substance behind TeamT5's "doubling" figure.
For security teams here, the takeaway is clear. Building firewall or intrusion-detection rules around the "signature" of a specific model like DeepSeek or ChatGPT isn't going to be very useful—the tools keep changing. What matters more is assuming exploit generation has gotten faster and tightening patch cycles accordingly, and not assuming that using an encrypted messenger like Signal makes you safe—checking the endpoint itself for compromise matters more. As the Slime22 case shows, how quickly you can detect lateral movement once an attacker is already inside will be the deciding factor.
The gap in fully autonomous attacks is also likely to narrow within the next few months. The "few months" the UK AI Safety Institute pointed to isn't much time at all, given how fast models get updated. It's worth keeping an eye out for reports of actual autonomous attacks built on open models within the next quarter or so—and defenders need to be automating at the same pace to keep up.
Comments