From Phishing to Malware: AI Becomes Russia's New Cyber Weapon in War on Ukraine

"Russian hackers' adoption of artificial intelligence (AI) in cyber attacks against Ukraine has reached a new level in the first half of 2025 (H1 2025), the country's State Service for Special Communications and Information Protection (SSSCIP) said. "Hackers now employ it not only to generate phishing messages, but some of the malware samples we have analyzed show clear signs of being generated with AI - and attackers are certainly not going to stop there," the agency said in a report published Wednesday."

"SSSCIP said 3,018 cyber incidents were recorded during the time period, up from 2,575 in the second half of 2024 (H2 2024). Local authorities and military entities witnessed an increase in attacks compared to H2 2024, while those targeting government and energy sectors declined. One notable attack observed involved UAC-0219's use of malware called WRECKSTEEL in attacks aimed at state administration bodies and critical infrastructure facilities in the country. There is evidence to suggest that the PowerShell data-stealing malware was developed using AI tools."

SSSCIP recorded 3,018 cyber incidents in H1 2025, up from 2,575 in H2 2024. Hackers employ AI to generate phishing messages and some malware samples show signs of AI generation. Attacks increased against local authorities and military entities, while incidents targeting government and energy sectors declined. UAC-0219 used PowerShell data-stealing malware called WRECKSTEEL against state administration and critical infrastructure, with evidence the malware was developed using AI tools. Other campaigns included UAC-0218 distributing HOMESTEEL via booby-trapped RAR archives; UAC-0226 spreading GIFTEDCROOK targeting defense innovation organizations; UAC-0227 using ClickFix-style tactics and SVG attachments to deliver Amatera and Strela Stealers.

Read at The Hacker News