From Phishing to Malware: AI Becomes Russia's New Cyber Weapon in War on Ukraine

According to the State Service for Special Communications and Information Protection (SSSCIP), Russian hackers’ use of artificial intelligence in cyber attacks against Ukraine reached a new level in the first half of 2025, with evidence that some malware samples were generated using AI tools and that AI is being employed beyond phishing.

SSSCIP said 3,018 cyber incidents were recorded in H1 2025, up from 2,575 in H2 2024, with increases noted across government and energy sector targets, while attacks on government and energy facilities declined. One notable incident involved UAC-0219 using malware called WRECKSTEEL against state administration bodies and critical infrastructure, and there is evidence to suggest the PowerShell data-stealing malware was developed with AI tools.

The agency also highlighted multiple phishing campaigns—by UAC-0218, UAC-0226, UAC-0227 and UAC-0125 (with Sandworm ties)—delivering various malicious payloads such as HOMESTEEL, GIFTEDCROOK, Amatera Stealer, and Kalambur. SSSCIP added that Russia-linked APT28 (UAC-0001) and the Sandworm group (UAC-0002) have continued cyber operations, including exploiting Roundcube and Zimbra webmail vulnerabilities to conduct zero-click attacks.