Russian State-Backed Hackers Employ AI-Powered Cyberattacks Against Ukraine
Russian state-backed threat actors have increasingly leveraged artificial intelligence to enhance the sophistication and effectiveness of their cyberattacks targeting Ukraine. According to Ukraine's Computer Emergency Response Team (CERT-UA), these hackers have utilized AI not only to craft more convincing phishing messages but also to develop advanced malware, such as the Wrecksteel backdoor associated with the UAC-0219 cyberespionage operation. AI-based PowerShell scripts have been observed as part of these campaigns, enabling more dynamic and adaptive attack techniques. The attackers have shifted their tactics to favor shorter, high-impact attacks using information-stealing tools and the exploitation of zero-click vulnerabilities, rather than focusing on maintaining long-term persistence within networks. These cyber intrusions are often synchronized with physical missile and drone strikes, amplifying the overall disruption to Ukrainian infrastructure and defenses. CERT-UA has noted a significant increase in both the frequency and complexity of these cyberattacks as the conflict continues. In July, CERT-UA discovered Russian malware that leveraged large language models (LLMs) to automate various stages of the cyberattack process, including system reconnaissance and data theft. This use of AI allowed attackers to generate commands in real-time, making their operations more efficient and harder to detect. The integration of AI into cyber operations has enabled Russian hackers to adapt quickly to Ukraine's increasingly robust cybersecurity measures. The attackers' use of AI extends to automating the entire attack chain, from initial reconnaissance to credential harvesting and even extortion communications. These developments represent a significant escalation in the cyber dimension of the conflict, as AI-driven attacks can operate at computer speeds and scale, outpacing traditional defensive measures. The synchronization of cyber and kinetic attacks demonstrates a coordinated strategy aimed at maximizing disruption and psychological impact. Ukrainian officials have emphasized that despite the increased volume and sophistication of attacks, the primary objectives of the Russian campaign have not been achieved. The ongoing use of AI in cyber operations highlights the evolving nature of modern warfare, where digital and physical domains are increasingly intertwined. The threat posed by AI-powered cyberattacks is not limited to Ukraine, as the techniques and tools developed in this conflict may be adopted by other state and non-state actors in future operations. The rapid advancement of AI capabilities in the hands of threat actors underscores the urgent need for equally advanced AI-assisted cyberdefense strategies. As the conflict persists, the cyber battlefield is expected to remain highly dynamic, with both sides racing to outpace each other's technological innovations.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
3 events from the most recent confirmed update back to the earliest known activity.
CERT-UA describes shift to shorter, theft-focused intrusions
CERT-UA assessed that Russian operators had shifted away from long-term persistence toward shorter intrusions focused on data theft, information-stealing tools, and exploitation of zero-click vulnerabilities. The report also said these cyber operations were being coordinated with missile and drone strikes to maximize disruption.
CERT-UA links AI-assisted malware to UAC-0219's Wrecksteel activity
CERT-UA said it observed AI-based PowerShell scripts in the Wrecksteel backdoor associated with the UAC-0219 cyberespionage operation. The disclosure provided technical detail on how AI was being incorporated into malware used in the campaign.
CERT-UA reports Russian hackers using AI in attacks on Ukraine
Ukraine’s Computer Emergency Response Team (CERT-UA) reported that Russian state-backed threat actors had increased their use of AI-enabled cyberattacks against Ukrainian targets. The agency said AI was being used to improve phishing lures and assist malware development as attackers adapted to Ukraine’s strengthened defenses.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
3 references tracked. Mallory keeps watching after this page renders.
Autonomous AI Hacking and the Future of Cybersecurity
schneier.com
Open sourceAI tapped by Russian hackers to counter Ukrainian defenses
scworld.com
Open sourceAutonomous AI hacking and the future of cybersecurity
csoonline.com
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russian Cyberattacks on Ukraine Employing AI-Generated Malware and Phishing
Russian cyber operations targeting Ukraine have escalated in sophistication, with Ukrainian authorities reporting a significant increase in the use of artificial intelligence (AI) by Russian threat actors in the first half of 2025. According to Ukraine’s State Service for Special Communications and Information Protection (SSSCIP) and the Computer Emergency Response Team of Ukraine (CERT-UA), over 3,000 cyber incidents were recorded during this period, marking a 20% rise compared to the same timeframe in the previous year. The adoption of AI has enabled Russian hackers to automate the creation of phishing messages and, more notably, to generate malicious code, including PowerShell-based malware. One prominent example is the WRECKSTEEL malware, attributed to the cyberespionage group UAC-0219, which was reportedly developed using AI tools and deployed against state administration bodies and critical infrastructure. Other Russian groups, such as UAC-0218, UAC-0226, and UAC-0227, have orchestrated phishing campaigns targeting Ukraine’s defense forces, local authorities, and organizations involved in defense innovation, using AI to craft convincing lures and deliver various stealer malware families like HOMESTEEL, GIFTEDCROOK, Amatera Stealer, and Strela Stealer. CERT-UA’s analysis indicates that as traditional phishing becomes less effective due to improved user awareness and defensive measures, Russian actors are shifting toward more transient, high-velocity attacks, described as the “Steal & Go” model, where data is exfiltrated quickly before infrastructure is taken down. The increased use of AI is also a response to Ukraine’s enhanced detection capabilities and international cooperation with cloud providers, which have forced attackers to reduce dwell time and adapt their tactics. Despite the rise in overall incidents, the number of high-impact attacks has declined, suggesting that Ukraine’s cyber defenses are becoming more effective at mitigating the most damaging threats. The Ukrainian government warns that the integration of AI into Russian cyber operations represents a new level of threat, with attackers likely to continue innovating in both malware development and social engineering. The ongoing cyber conflict underscores the importance of continuous improvement in defensive technologies and international collaboration to counter rapidly evolving adversarial tactics. Ukrainian authorities emphasize vigilance, as the use of AI in cyberattacks is expected to expand further, potentially enabling more sophisticated and harder-to-detect campaigns. The focus on targeting military, governmental, and critical infrastructure entities highlights the strategic intent behind these operations, aiming to disrupt Ukraine’s defense and administrative capabilities. The shift in Russian tactics also reflects broader trends in cyber warfare, where automation and AI are increasingly leveraged to overcome improved security postures. Ukrainian agencies continue to monitor and analyze these developments, sharing intelligence with partners to bolster collective resilience. The reports from SSSCIP and CERT-UA serve as a warning to other nations about the accelerating integration of AI into state-sponsored cyber operations. The Ukrainian experience demonstrates both the challenges and the necessity of adapting to adversaries who rapidly incorporate emerging technologies into their attack methodologies. As the conflict persists, the cyber domain remains a critical front, with AI-driven threats poised to play an ever-larger role in shaping the security landscape.
Jun 29, 2026
AI-Driven Ransomware and Extortion Surge in Europe
European organizations are experiencing a significant increase in ransomware and extortion attacks, with threat actors leveraging artificial intelligence to accelerate and enhance their operations. According to CrowdStrike’s 2025 European Threat Landscape Report, Europe now accounts for nearly 22% of global ransomware and extortion victims, making it the second most targeted region after North America. AI is enabling adversaries to breach networks and deploy ransomware more quickly, with groups like SCATTERED SPIDER reducing their attack cycle to approximately 24 hours. The most targeted countries include the United Kingdom, Germany, France, Italy, and Spain, and affected sectors span manufacturing, professional services, technology, and retail. Attackers are also employing advanced social engineering tactics, such as fake CAPTCHA lures, to compromise victims. The report also highlights a rise in hacktivism and nation-state cyber operations, particularly from Russian and North Korean actors, amid ongoing geopolitical tensions. Russian threat actors have shifted focus toward Ukraine and related regions since the 2022 invasion, while North Korea is reportedly supporting Russian operations and targeting Ukraine. The European threat landscape is described as increasingly complex, with eCrime, espionage, and disruptive attacks posing significant risks to both public and private sector organizations. Security teams are urged to adapt to the evolving threat environment, where AI-driven automation and deception are reshaping the speed and scale of cyberattacks.
Jun 29, 2026
Emergence and Impact of AI-Enabled Cyberattacks and Social Engineering
Artificial intelligence is rapidly transforming the cyber threat landscape, with both financially motivated and nation-state actors leveraging AI to enhance the effectiveness and profitability of their attacks. According to Microsoft's Digital Defense Report 2025, phishing emails generated with AI are 4.5 times more likely to deceive recipients, achieving a 54% click-through rate compared to 12% for traditional phishing, and making phishing scams up to 50 times more profitable. Attackers are increasingly using AI not only to craft convincing phishing messages but also to automate multi-stage attack chains, including voice cloning and deepfake videos, which are being adopted by nation-state actors. The report highlights that AI contributed to the rise of ClickFix, which has become the most common initial access vector, accounting for 47% of attacks, surpassing phishing at 35%. Financially motivated operations now represent 52% of all known attacks, while only 4% are tied to espionage, indicating a shift in attacker priorities. Microsoft emphasizes that attackers are now 'logging in, not breaking in,' using AI-enhanced social engineering to compromise accounts through legitimate platforms. In the financial services sector, experts stress the need for robust prevention, detection, and response cycles, and recommend setting strict guardrails before deploying AI tools at scale. The distinction between AI models and AI agents is crucial, as the latter require more oversight due to their autonomous capabilities. Cloud misconfigurations remain a significant risk, underscoring the importance of security-first design in an era of AI-driven threats. The next 12–24 months are expected to see identity attacks, supply chain compromises, and AI-enabled adversaries as the dominant threats to financial institutions. Meanwhile, Chinese state-aligned threat actors have begun experimenting with AI-optimized attack chains, such as using ChatGPT and DeepSeek to generate phishing emails and enhance backdoor malware. However, early results suggest that the effectiveness of AI in the hands of less skilled actors may be limited, as demonstrated by the poor quality of phishing emails produced by the group known as DropPitch. Despite these shortcomings, the trend toward AI-driven cyberattacks is clear, and organizations are urged to adapt their defenses accordingly. The growing sophistication and accessibility of AI tools are expected to incentivize more threat actors to incorporate AI into their operations, raising the stakes for defenders across all sectors. Security leaders are advised to focus on collaboration, intelligence sharing, and continuous improvement of cyber resilience strategies to counter the evolving threat landscape. The convergence of AI with traditional attack vectors is reshaping the priorities and tactics of both attackers and defenders, making AI security a top concern for CISOs and security teams worldwide.
Jun 29, 2026