Ukraine sees surge in AI-Powered cyberattacks by Russia-linked Threat Actors

According to the State Service for Special Communications and Information Protection (SSSCIP), Russia-linked actors are increasingly using AI to craft phishing and malware attacks against Ukraine, with some samples showing AI-generated code. In H1 2025, Ukraine recorded 3,018 cyber incidents, up from 2,575 in late 2024, with attacks on local authorities and military entities rising while those on government and energy sectors declined.

The report details several threat actors, including UAC-0219, UAC-0218 and UAC-0226, with UAC-0219 leveraging WRECKSTEEL to steal data and take screenshots and likely using AI to generate PowerShell scripts; UAC-0218 has been active since 2024 but intensified in early 2025, sending phishing emails with links to E-Disk archives hosting password-protected Office files and an encrypted VBE script delivering HOMESTEEL.

UAC-0226 targets defence, government and law enforcement sectors via malicious attachments and deploys Reverse-shell and GIFTEDCROOK, a stealer that extracts browser data and sends it to a hacker-controlled Telegram chat; UAC-0227 has been active since at least March 2025, with CERT-UA monitoring campaigns aimed at local governments and critical infrastructure.

The report also notes Russia-linked APT28 exploited XSS flaws in Roundcube and Zimbra webmail, and concludes that the use of legitimate online resources for malicious purposes is not new, though the number of platforms exploited by Russian hackers has been rising.