Snapshot from Aug 27, 2026 at 07:00 UTC. For live data and tracking: View Live
Events / Geopolitical / Chinese hackers use DeepSeek to scale attacks
International cyberattack

Chinese hackers use DeepSeek to scale attacks

Analysis based on 7 articles · First reported Aug 25, 2026 · Last updated Aug 25, 2026

Sentiment
-45
Attention
6
Articles
7
Market Impact
General
Live prominence charts, article sentiment distribution, and event development timeline available on the Ergen Dashboard
Market Impact

The news heightens concerns about AI-enabled cyber threats, potentially impacting cybersecurity spending and the reputations of AI companies like DeepSeek, Anthropic, and OpenAI. It may also influence regulatory scrutiny and international tensions, affecting tech stocks and cybersecurity firms.

Cybersecurity Artificial Intelligence Technology
Event Summary

Chinese state-affiliated hackers have more than doubled their cyberattacks by integrating DeepSeek and other open-source AI models into their operations, according to a report by Taiwanese research firm TeamT5. The hackers use AI for reconnaissance, exploit creation, and lateral movement, targeting foreign companies and institutions. Specific groups such as Grimfengxi, Huapi, Teleboyi, and Slime22 have been identified using DeepSeek, ChatGPT, and Claude Code. The report also highlights a startup selling hacking tools for 300,000-500,000 yuan, with customers including groups linked to Mustang Panda. Anthropic and OpenAI have acknowledged and are working to disrupt such abuse.

Key Actions
80 China doubled cyberattacks
60 Slime22 breached systems Taiwan
50 Huapi attacked email system Taiwan
40 Grimfengxi created exploit codes
40 Anthropic restricted access China
30 Teleboyi collected IP addresses
20 OpenAI committed to responsible use
Entities Involved
cnt
China
China is the origin of the state-affiliated hackers, leading to increased international scrutiny and potential sanctions or diplomatic tensions.
Importance 100.0 Sentiment -50.0
priv
DeepSeek
DeepSeek is the primary AI tool used by Chinese hackers due to its low guardrails and cost. This association could harm its reputation and lead to stricter regulations or sanctions.
Importance 90.0 Sentiment -30.0
cnt
United States
The US is a target of these cyberattacks and is concerned about AI-enabled threats, potentially leading to increased cybersecurity measures and regulatory actions.
Importance 70.0 Sentiment -20.0
priv
TeamT5
TeamT5 is the research firm that uncovered the cyberattacks, enhancing its credibility and visibility in the cybersecurity industry.
Importance 70.0 Sentiment 20.0
priv
Anthropic
Anthropic's Claude Code was used by hackers, but the company has taken steps to block Chinese-controlled entities and is committed to preventing abuse, mitigating negative impact.
Importance 60.0 Sentiment -10.0
priv
OpenAI
OpenAI's ChatGPT was used in an attack on a Western think tank, but the company is committed to disrupting abuse, which may limit reputational damage.
Importance 60.0 Sentiment -10.0
cnt
Taiwan
Taiwan is a target of several attacks, including on its companies, heightening security concerns and potentially affecting its tech industry.
Importance 60.0 Sentiment -30.0
mil
Mustang Panda
Mustang Panda is a hacking group linked to the Chinese government, and its involvement in these attacks increases its notoriety and potential for sanctions.
Importance 50.0 Sentiment -40.0
priv
CyCraft
CyCraft identified the use of ChatGPT in an attack, contributing to the report and potentially boosting its reputation.
Importance 40.0 Sentiment 15.0
govactor
United States — United States Department of Justice
The DOJ has attributed Mustang Panda to the Chinese government, supporting the report's findings and potentially leading to legal actions.
Importance 40.0 Sentiment 10.0
mil
Grimfengxi
Grimfengxi used DeepSeek to create exploit codes, demonstrating the practical use of AI in cyberattacks.
Importance 40.0 Sentiment -30.0
mil
Huapi
Huapi attacked a Taiwanese company's email system using DeepSeek, highlighting the targeting of Taiwan.
Importance 40.0 Sentiment -30.0
mil
Teleboyi
Teleboyi used DeepSeek to collect IP addresses and map domains, showing reconnaissance capabilities.
Importance 40.0 Sentiment -30.0
mil
Slime22
Slime22 breached a Taiwanese tech company using Claude Code, demonstrating lateral movement techniques.
Importance 40.0 Sentiment -30.0
priv
Moonshot AI
Moonshot's Kimi K3 model is mentioned as more powerful but not used by hackers due to cost, so minimal direct impact.
Importance 30.0 Sentiment 10.0
+ 2 more entities View on Dashboard
Relationships
China related ↔ DeepSeek
China strategic rivals ↔ United States China views the United States as a strategic rival, characterized by ongoing trade disputes, technological competition,
China related ↔ Anthropic
China related ↔ OpenAI
China adversary ↔ Taiwan China claims Taiwan as its own territory and frequently conducts aggressive military blockade drills, refusing to rule o
China related ↔ United States — United States Department of Justice
DeepSeek related ↔ United States
DeepSeek related ↔ Anthropic
DeepSeek related ↔ OpenAI
DeepSeek related ↔ Taiwan
United States related ↔ Anthropic
United States related ↔ OpenAI
United States security partner ↔ Taiwan The United States acts as Taiwan's primary security partner and arms supplier, maintaining robust economic ties and semi
United States related ↔ United States — United States Department of Justice
Anthropic competitor ↔ OpenAI Anthropic is a leading direct competitor to OpenAI in the rapidly evolving artificial intelligence market, developing an
+ 5 more relationships View on Dashboard
ERGEN INTELLIGENCE
Track this event live

Set up alerts, explore entity relationships, search across thousands of events, and build custom intelligence feeds.

Open Dashboard

About Ergen

Ergen is a news intelligence platform that converts raw news articles into structured data. It tracks events, entities, and the relationships between them, with sentiment and attention metrics derived from thousands of articles. Pages on this site are daily static snapshots from the platform's live database. For real-time tracking, search, and alerts, the full dashboard is at app.ergen.ai.