From Phishing to Malware: AI Becomes Russia's New Cyber Weapon in War on Ukraine

Summary: Ukraine's SSSCIP recorded 3,018 cyber incidents in the first half of 2025, up from 2,575 in the second half of 2024, and said some analyzed malware samples show clear signs of being generated with AI. The agency attributed attacks to groups including UAC-0219 with its PowerShell data-stealing malware WRECKSTEEL, APT28 exploiting Roundcube and Zimbra webmail flaws for zero-click credential theft, and Sandworm targeting energy, defense, ISP, and research sectors alongside kinetic strikes.
Why it matters: The incident count rose by 443 between reporting periods while attackers moved AI from writing phishing lures into producing the malware itself, and groups like Sandworm are timing intrusions to battlefield operations - a combination that shortens the gap between a campaign and its physical effect.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2023-43770 CVE-2024-27443 CVE-2024-37383 CVE-2025-27915 CVE-2025-49113
Related: Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions Cyber Risks ·
CVE-2025-49113: Round Cube Webmail Deserialization of Untrusted Data Vulnerability Known Exploited Vulnerabilities · Feb 20, 2026
CVE-2025-27915: Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability Known Exploited Vulnerabilities · Oct 07, 2025