The reporting does not establish that every measured attack increase was caused by AI rather than concurrent operational changes. Per-campaign model attribution is incomplete.
Limits and uncertaintyCase · DiggingBeagle record
TeamT5 says Chinese state-linked hackers scaled attacks with DeepSeek and other models
TeamT5 reported that Chinese state-affiliated cyber groups increased attack volume after integrating DeepSeek and other open-source models into operational workflows. Researchers described AI use for mundane task delegation and malware development, while also noting that the exact model could not always be identified.
Assessment profile
Assessment method- Setting
- allegation
- Exploitation
- not established
- AI role
- WITH AI
Basis and provenance
The report attributes an attack-volume increase and model preference to TeamT5 but does not establish causation or per-campaign model identity. Generic locators and missing campaign-level proof leave evidence and impact grading unresolved. Assessment is a desk review of the retained canonical Claims and cited Source metadata at their recorded cutoff, not a new external verification. Impact remains ungraded. Stored evidence uses source-level locators; passage-level corroboration remains required.
Assessed Sep 24, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-USES · CLM-MODEL · CLM-DOUBLE · CLM-SCALE2 · CLM-ATTR-LIMIT · Bloomberg Law - Chinese hackers use DeepSeek to boost attacks
At a glance
Claims & evidence
CLM-USESResearchers described AI being used both for routine operational work and for developing more advanced malicious software.supported
Basis: reported finding
- supportsBloomberg Law - Chinese hackers use DeepSeek to boost attacksrole not specified
SRC-BLOOMBERGLAW-DEEPSEEK-AUG24
Researchers described AI being used both for routine operational work and for developing more advanced malicious software.
CLM-MODELDeepSeek is reported as popular among the groups, but TeamT5 said it cannot identify the exact model used in every intrusion.contested
Basis: reported finding
- supportsBloomberg Law - Chinese hackers use DeepSeek to boost attacksrole not specified
SRC-BLOOMBERGLAW-DEEPSEEK-AUG24
DeepSeek is reported as popular among the groups, but TeamT5 said it cannot identify the exact model used in every intrusion.
CLM-DOUBLEBloomberg reporting attributes to TeamT5 the claim that attack volume more than doubled after AI adoption.supported
Basis: reported finding
- supportsBloomberg Law - Chinese hackers use DeepSeek to boost attacksrole not specified
SRC-BLOOMBERGLAW-DEEPSEEK-AUG24
Bloomberg reporting attributes to TeamT5 the claim that attack volume more than doubled after AI adoption.
CLM-SCALE2TeamT5 told Bloomberg Law that state-affiliated groups more than doubled attack volume after integrating AI into operations.supported
Basis: reported finding
- supportsBloomberg Law - Chinese hackers use DeepSeek to boost attacksrole not specified
SRC-BLOOMBERGLAW-DEEPSEEK-AUG24
TeamT5 told Bloomberg Law that state-affiliated groups more than doubled attack volume after integrating AI into operations.
CLM-ATTR-LIMITTeamT5 said the specific model could not always be determined, although DeepSeek models were popular among China-based attackers.supported
Basis: reported finding
- supportsBloomberg Law - Chinese hackers use DeepSeek to boost attacksrole not specified
SRC-BLOOMBERGLAW-DEEPSEEK-AUG24
TeamT5 said the specific model could not always be determined, although DeepSeek models were popular among China-based attackers.
Unknowns and contradictions
- The reporting does not establish that every measured attack increase was caused by AI rather than concurrent operational changes.
- Per-campaign model attribution is incomplete.
DeepSeek is reported as popular among the groups, but TeamT5 said it cannot identify the exact model used in every intrusion. has a contested assessment or contradictory evidence.
Sources and citation
Material revision history
- Sep 25, 2026 · Published version · first publication · revision 39