Escalating Cyber and Infrastructure Measures in Russia-Ukraine Conflict
Russia has intensified its campaign against Ukraine's energy infrastructure, deploying advanced weaponry to target not only electricity generation but also natural gas production, with a focus on the most vulnerable regions. In response, Ukraine has launched strikes on Russian energy sites deep within Russian territory, forcing Moscow to curtail some energy exports and ration fuel internally. The ongoing attacks have placed significant strain on Ukraine's energy grid, which relies heavily on nuclear power plants, thermal power, and hydroelectric sources, while the Zaporizhzhia nuclear plant remains under Russian control and offline.
Concurrently, Russia has implemented new digital security measures, including 24-hour mobile internet blackouts for travelers returning from abroad, to prevent Ukrainian drones from exploiting domestic SIM cards for navigation. These restrictions have caused unexpected outages, particularly in border regions, and are part of a broader effort to expand the powers of the FSB to order shutdowns of mobile and internet access in response to perceived threats. Despite these measures, government-approved digital services remain accessible, and officials have indicated that some restrictions will persist around critical infrastructure until the end of the conflict.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
4 events from the most recent confirmed update back to the earliest known activity.
Ukraine launches deep strikes on Russian energy sites
Ukraine carried out long-range attacks against Russian energy facilities as part of the escalating energy war between the two countries. The strikes contributed to fuel shortages and export restrictions inside Russia.
Ukraine hardens grid and expands backup energy measures
In response to the renewed Russian strikes, Ukraine fortified parts of its power grid and invested in alternative generation and energy storage to reduce the impact of outages. These defensive and resilience measures were part of its effort to sustain electricity supply during continued attacks.
Russia begins annual strikes on Ukraine's energy infrastructure
Russia renewed its seasonal campaign targeting Ukraine's energy infrastructure, using more advanced weapons and focusing on both electricity generation and natural gas production. The attacks hit critical infrastructure including thermal and other power facilities, worsening pressure on a grid already reduced to about half its prewar capacity.
Russia imposes 24-hour mobile internet blackout on returning travelers
Russian authorities imposed a 24-hour mobile internet blackout affecting travelers returning home, according to reporting on the measure. The restriction reflects a domestic communications control response linked to the broader wartime drone threat environment.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
2 references tracked. Mallory keeps watching after this page renders.
See the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russian-Linked Cyberattacks Hit Ukraine and Spill Into Wider European Targets
Ukrainian government, military, banking, and energy targets were repeatedly disrupted by cyber operations tied to Russia and the war around Ukraine. Reports describe attacks on a Ukrainian power station, outages affecting the websites of Ukraine’s defense ministry and major banks, and broader disruptive activity against the country’s financial sector. The UK government later said technical analysis by the National Cyber Security Centre assessed that Russia’s **GRU** was almost certainly involved in the February 2022 distributed denial-of-service attacks on Ukrainian banking targets, framing the incidents as part of continued Russian aggression. The campaign also expanded beyond Ukraine through both state-linked and pro-Russian actors. **Killnet**, a Russia-aligned hacktivist group, claimed retaliatory **DDoS** attacks on Lithuanian government and business websites after restrictions affecting transit to Kaliningrad, while other reporting said Russian-backed actors continued destructive operations against Ukraine, including **wiper malware** and attempted power-grid attacks. At the same time, pro-Ukrainian hackers mounted hack-and-leak operations against Russian institutions, underscoring how the conflict evolved into a broader regional cyber confrontation affecting governments, critical infrastructure, and financial services.
Jun 29, 2026
Russian State-Backed Hackers Employ AI-Powered Cyberattacks Against Ukraine
Russian state-backed threat actors have increasingly leveraged artificial intelligence to enhance the sophistication and effectiveness of their cyberattacks targeting Ukraine. According to Ukraine's Computer Emergency Response Team (CERT-UA), these hackers have utilized AI not only to craft more convincing phishing messages but also to develop advanced malware, such as the Wrecksteel backdoor associated with the UAC-0219 cyberespionage operation. AI-based PowerShell scripts have been observed as part of these campaigns, enabling more dynamic and adaptive attack techniques. The attackers have shifted their tactics to favor shorter, high-impact attacks using information-stealing tools and the exploitation of zero-click vulnerabilities, rather than focusing on maintaining long-term persistence within networks. These cyber intrusions are often synchronized with physical missile and drone strikes, amplifying the overall disruption to Ukrainian infrastructure and defenses. CERT-UA has noted a significant increase in both the frequency and complexity of these cyberattacks as the conflict continues. In July, CERT-UA discovered Russian malware that leveraged large language models (LLMs) to automate various stages of the cyberattack process, including system reconnaissance and data theft. This use of AI allowed attackers to generate commands in real-time, making their operations more efficient and harder to detect. The integration of AI into cyber operations has enabled Russian hackers to adapt quickly to Ukraine's increasingly robust cybersecurity measures. The attackers' use of AI extends to automating the entire attack chain, from initial reconnaissance to credential harvesting and even extortion communications. These developments represent a significant escalation in the cyber dimension of the conflict, as AI-driven attacks can operate at computer speeds and scale, outpacing traditional defensive measures. The synchronization of cyber and kinetic attacks demonstrates a coordinated strategy aimed at maximizing disruption and psychological impact. Ukrainian officials have emphasized that despite the increased volume and sophistication of attacks, the primary objectives of the Russian campaign have not been achieved. The ongoing use of AI in cyber operations highlights the evolving nature of modern warfare, where digital and physical domains are increasingly intertwined. The threat posed by AI-powered cyberattacks is not limited to Ukraine, as the techniques and tools developed in this conflict may be adopted by other state and non-state actors in future operations. The rapid advancement of AI capabilities in the hands of threat actors underscores the urgent need for equally advanced AI-assisted cyberdefense strategies. As the conflict persists, the cyber battlefield is expected to remain highly dynamic, with both sides racing to outpace each other's technological innovations.
Jun 29, 2026
Russian Cyberattacks on Ukraine Employing AI-Generated Malware and Phishing
Russian cyber operations targeting Ukraine have escalated in sophistication, with Ukrainian authorities reporting a significant increase in the use of artificial intelligence (AI) by Russian threat actors in the first half of 2025. According to Ukraine’s State Service for Special Communications and Information Protection (SSSCIP) and the Computer Emergency Response Team of Ukraine (CERT-UA), over 3,000 cyber incidents were recorded during this period, marking a 20% rise compared to the same timeframe in the previous year. The adoption of AI has enabled Russian hackers to automate the creation of phishing messages and, more notably, to generate malicious code, including PowerShell-based malware. One prominent example is the WRECKSTEEL malware, attributed to the cyberespionage group UAC-0219, which was reportedly developed using AI tools and deployed against state administration bodies and critical infrastructure. Other Russian groups, such as UAC-0218, UAC-0226, and UAC-0227, have orchestrated phishing campaigns targeting Ukraine’s defense forces, local authorities, and organizations involved in defense innovation, using AI to craft convincing lures and deliver various stealer malware families like HOMESTEEL, GIFTEDCROOK, Amatera Stealer, and Strela Stealer. CERT-UA’s analysis indicates that as traditional phishing becomes less effective due to improved user awareness and defensive measures, Russian actors are shifting toward more transient, high-velocity attacks, described as the “Steal & Go” model, where data is exfiltrated quickly before infrastructure is taken down. The increased use of AI is also a response to Ukraine’s enhanced detection capabilities and international cooperation with cloud providers, which have forced attackers to reduce dwell time and adapt their tactics. Despite the rise in overall incidents, the number of high-impact attacks has declined, suggesting that Ukraine’s cyber defenses are becoming more effective at mitigating the most damaging threats. The Ukrainian government warns that the integration of AI into Russian cyber operations represents a new level of threat, with attackers likely to continue innovating in both malware development and social engineering. The ongoing cyber conflict underscores the importance of continuous improvement in defensive technologies and international collaboration to counter rapidly evolving adversarial tactics. Ukrainian authorities emphasize vigilance, as the use of AI in cyberattacks is expected to expand further, potentially enabling more sophisticated and harder-to-detect campaigns. The focus on targeting military, governmental, and critical infrastructure entities highlights the strategic intent behind these operations, aiming to disrupt Ukraine’s defense and administrative capabilities. The shift in Russian tactics also reflects broader trends in cyber warfare, where automation and AI are increasingly leveraged to overcome improved security postures. Ukrainian agencies continue to monitor and analyze these developments, sharing intelligence with partners to bolster collective resilience. The reports from SSSCIP and CERT-UA serve as a warning to other nations about the accelerating integration of AI into state-sponsored cyber operations. The Ukrainian experience demonstrates both the challenges and the necessity of adapting to adversaries who rapidly incorporate emerging technologies into their attack methodologies. As the conflict persists, the cyber domain remains a critical front, with AI-driven threats poised to play an ever-larger role in shaping the security landscape.
Jun 29, 2026