Russian Cyberattacks on Ukraine Employing AI-Generated Malware and Phishing
Russian cyber operations targeting Ukraine have escalated in sophistication, with Ukrainian authorities reporting a significant increase in the use of artificial intelligence (AI) by Russian threat actors in the first half of 2025. According to Ukraine’s State Service for Special Communications and Information Protection (SSSCIP) and the Computer Emergency Response Team of Ukraine (CERT-UA), over 3,000 cyber incidents were recorded during this period, marking a 20% rise compared to the same timeframe in the previous year. The adoption of AI has enabled Russian hackers to automate the creation of phishing messages and, more notably, to generate malicious code, including PowerShell-based malware. One prominent example is the WRECKSTEEL malware, attributed to the cyberespionage group UAC-0219, which was reportedly developed using AI tools and deployed against state administration bodies and critical infrastructure. Other Russian groups, such as UAC-0218, UAC-0226, and UAC-0227, have orchestrated phishing campaigns targeting Ukraine’s defense forces, local authorities, and organizations involved in defense innovation, using AI to craft convincing lures and deliver various stealer malware families like HOMESTEEL, GIFTEDCROOK, Amatera Stealer, and Strela Stealer. CERT-UA’s analysis indicates that as traditional phishing becomes less effective due to improved user awareness and defensive measures, Russian actors are shifting toward more transient, high-velocity attacks, described as the “Steal & Go” model, where data is exfiltrated quickly before infrastructure is taken down. The increased use of AI is also a response to Ukraine’s enhanced detection capabilities and international cooperation with cloud providers, which have forced attackers to reduce dwell time and adapt their tactics. Despite the rise in overall incidents, the number of high-impact attacks has declined, suggesting that Ukraine’s cyber defenses are becoming more effective at mitigating the most damaging threats. The Ukrainian government warns that the integration of AI into Russian cyber operations represents a new level of threat, with attackers likely to continue innovating in both malware development and social engineering. The ongoing cyber conflict underscores the importance of continuous improvement in defensive technologies and international collaboration to counter rapidly evolving adversarial tactics. Ukrainian authorities emphasize vigilance, as the use of AI in cyberattacks is expected to expand further, potentially enabling more sophisticated and harder-to-detect campaigns. The focus on targeting military, governmental, and critical infrastructure entities highlights the strategic intent behind these operations, aiming to disrupt Ukraine’s defense and administrative capabilities. The shift in Russian tactics also reflects broader trends in cyber warfare, where automation and AI are increasingly leveraged to overcome improved security postures. Ukrainian agencies continue to monitor and analyze these developments, sharing intelligence with partners to bolster collective resilience. The reports from SSSCIP and CERT-UA serve as a warning to other nations about the accelerating integration of AI into state-sponsored cyber operations. The Ukrainian experience demonstrates both the challenges and the necessity of adapting to adversaries who rapidly incorporate emerging technologies into their attack methodologies. As the conflict persists, the cyber domain remains a critical front, with AI-driven threats poised to play an ever-larger role in shaping the security landscape.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
8 events from the most recent confirmed update back to the earliest known activity.
CERT-UA reports H2 2025 decline in incidents and shift to re-compromise tactics
In the second half of 2025, CERT-UA said cyber incidents targeting Ukraine declined for the first time since Russia's full-scale invasion began, attributing the drop to stronger Ukrainian defenses. The same assessment said Russian actors increasingly tried to re-compromise previously breached environments for follow-on espionage and relied more on social engineering for initial access, including activity linked to APT28 and Void Blizzard.
SSSCIP/CERT-UA publishes assessment on AI-driven Russian cyber tactics
In early October 2025, Ukrainian cyber authorities publicly released an assessment summarizing H1 2025 activity, warning that Russian hackers are increasingly using AI, zero-click exploitation, and legitimate cloud services in attacks against Ukraine. The report also said some campaigns extended beyond Ukraine to target European Union countries.
Ukraine says Sandworm cyber operations remain tied to kinetic strikes
Ukrainian authorities reported in H1 2025 that some Russian cyber operations, particularly those linked to Sandworm, continued to be synchronized with missile and drone attacks. The assessment highlighted the ongoing hybrid nature of Russian operations combining cyber and military activity.
APT28 conducts zero-click webmail attacks via Roundcube and Zimbra XSS
In the first half of 2025, APT28 was observed exploiting XSS flaws in Roundcube and Zimbra to carry out zero-click attacks that stole credentials and exfiltrated email data. Ukrainian reporting also noted renewed activity against Roundcube, including exploitation tied to CVE-2023-43770.
Multiple UAC clusters run phishing campaigns with stealers and backdoors
In H1 2025, Ukrainian defenders documented campaigns by clusters including UAC-0218, UAC-0226, and UAC-0227 delivering malware such as HOMESTEEL, GIFTEDCROOK, Amatera Stealer, Strela Stealer, and the Kalambur/SUMBUR backdoor. These operations were part of a broader Russian shift toward credential theft and rapid data exfiltration.
UAC-0219 deploys WRECKSTEEL with suspected AI-generated code
During H1 2025, UAC-0219 targeted Ukrainian state administration bodies and critical infrastructure with the PowerShell data-stealing malware WRECKSTEEL. Ukrainian officials said some observed scripts appeared to have been generated or assisted by AI.
Russian actors expand AI use in cyber operations against Ukraine
In the first half of 2025, Ukrainian authorities observed Russia-linked threat actors increasingly using AI to craft phishing lures, automate operations, and in some cases assist malware development. The trend reflected a shift toward shorter, more adaptive campaigns as older tactics became less effective against Ukrainian defenses.
Russian cyber incidents against Ukraine rise in H1 2025
Ukraine’s State Service for Special Communications and Information Protection recorded 3,018 cyber incidents in the first half of 2025, up from 2,575 in the second half of 2024. The increase was accompanied by heavier targeting of local authorities and military entities and reduced focus on some government and energy targets.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
4 references tracked. Mallory keeps watching after this page renders.
Evolving Russian cyberattacks against Ukraine detailed | brief | SC Media
scworld.com
Open sourceUkraine sees surge in AI-Powered cyberattacks by Russia-linked Threat Actors
securityaffairs.com
Open sourceFrom Phishing to Malware: AI Becomes Russia's New Cyber Weapon in War on Ukraine
thehackernews.com
Open sourceRussian hackers turn to AI as old tactics fail, Ukrainian CERT says
therecord.media
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russian State-Backed Hackers Employ AI-Powered Cyberattacks Against Ukraine
Russian state-backed threat actors have increasingly leveraged artificial intelligence to enhance the sophistication and effectiveness of their cyberattacks targeting Ukraine. According to Ukraine's Computer Emergency Response Team (CERT-UA), these hackers have utilized AI not only to craft more convincing phishing messages but also to develop advanced malware, such as the Wrecksteel backdoor associated with the UAC-0219 cyberespionage operation. AI-based PowerShell scripts have been observed as part of these campaigns, enabling more dynamic and adaptive attack techniques. The attackers have shifted their tactics to favor shorter, high-impact attacks using information-stealing tools and the exploitation of zero-click vulnerabilities, rather than focusing on maintaining long-term persistence within networks. These cyber intrusions are often synchronized with physical missile and drone strikes, amplifying the overall disruption to Ukrainian infrastructure and defenses. CERT-UA has noted a significant increase in both the frequency and complexity of these cyberattacks as the conflict continues. In July, CERT-UA discovered Russian malware that leveraged large language models (LLMs) to automate various stages of the cyberattack process, including system reconnaissance and data theft. This use of AI allowed attackers to generate commands in real-time, making their operations more efficient and harder to detect. The integration of AI into cyber operations has enabled Russian hackers to adapt quickly to Ukraine's increasingly robust cybersecurity measures. The attackers' use of AI extends to automating the entire attack chain, from initial reconnaissance to credential harvesting and even extortion communications. These developments represent a significant escalation in the cyber dimension of the conflict, as AI-driven attacks can operate at computer speeds and scale, outpacing traditional defensive measures. The synchronization of cyber and kinetic attacks demonstrates a coordinated strategy aimed at maximizing disruption and psychological impact. Ukrainian officials have emphasized that despite the increased volume and sophistication of attacks, the primary objectives of the Russian campaign have not been achieved. The ongoing use of AI in cyber operations highlights the evolving nature of modern warfare, where digital and physical domains are increasingly intertwined. The threat posed by AI-powered cyberattacks is not limited to Ukraine, as the techniques and tools developed in this conflict may be adopted by other state and non-state actors in future operations. The rapid advancement of AI capabilities in the hands of threat actors underscores the urgent need for equally advanced AI-assisted cyberdefense strategies. As the conflict persists, the cyber battlefield is expected to remain highly dynamic, with both sides racing to outpace each other's technological innovations.
Jun 29, 2026
Russian Cyber Operations Hit Ukraine and Expand to Allied Governments
Ukraine has remained a primary target and proving ground for Russian-linked cyber operations, from the **Petya/NotPetya** outbreak that began via Ukrainian networks and crippled government agencies, banks, transport systems, industrial firms, and Chernobyl monitoring systems, to later destructive malware planted in dozens of Ukrainian government and private-sector networks. Microsoft said the 2022 malware was discovered alongside website defacements affecting Ukrainian entities and appeared designed for later activation, while officials warned such activity could accompany broader military escalation. Earlier attacks on Ukraine’s power grid, election systems, and software supply chain underscored how repeated intrusions against the country have had consequences far beyond its borders. The campaign has also extended well outside Ukraine through espionage and supply-chain compromises attributed by officials and researchers to Russian state actors. Microsoft reported that hackers aligned with Russia targeted organizations in **42 countries** supporting Ukraine, with nearly two-thirds of espionage victims in NATO states and successful intrusions resulting in data theft in at least a quarter of cases. Separately, suspected **S.V.R.** operators were tied to a broad intrusion set affecting at least 40 organizations, including U.S. government agencies, technology firms, and cybersecurity companies, reinforcing warnings that attacks first seen in Ukraine can evolve into wider operations against allied governments and critical sectors.
Jun 29, 2026
AI-Driven Ransomware and Extortion Surge in Europe
European organizations are experiencing a significant increase in ransomware and extortion attacks, with threat actors leveraging artificial intelligence to accelerate and enhance their operations. According to CrowdStrike’s 2025 European Threat Landscape Report, Europe now accounts for nearly 22% of global ransomware and extortion victims, making it the second most targeted region after North America. AI is enabling adversaries to breach networks and deploy ransomware more quickly, with groups like SCATTERED SPIDER reducing their attack cycle to approximately 24 hours. The most targeted countries include the United Kingdom, Germany, France, Italy, and Spain, and affected sectors span manufacturing, professional services, technology, and retail. Attackers are also employing advanced social engineering tactics, such as fake CAPTCHA lures, to compromise victims. The report also highlights a rise in hacktivism and nation-state cyber operations, particularly from Russian and North Korean actors, amid ongoing geopolitical tensions. Russian threat actors have shifted focus toward Ukraine and related regions since the 2022 invasion, while North Korea is reportedly supporting Russian operations and targeting Ukraine. The European threat landscape is described as increasingly complex, with eCrime, espionage, and disruptive attacks posing significant risks to both public and private sector organizations. Security teams are urged to adapt to the evolving threat environment, where AI-driven automation and deception are reshaping the speed and scale of cyberattacks.
Jun 29, 2026