AI is becoming part of Russia’s cyber arsenal

Russia is using artificial intelligence to expand the scale and efficiency of cyber-espionage operations targeting Ukraine and Europe, turning commercially available AI models into an additional layer of its intelligence capabilities. A campaign linked to Russian state-backed hackers used Anthropic’s Claude to conduct reconnaissance, develop attack tools, maintain access to compromised systems and analyse stolen information. The operation shows how AI is beginning to move beyond its role as an assistant for individual hackers and become part of the operational infrastructure of a wider cyber campaign.

Anthropic attributed the activity to a group it designated GTG-20006 and said its tactics and targeting were consistent with the Russian state-backed group Midnight Blizzard, which is associated with Russia’s Foreign Intelligence Service. More than 20 organisations were targeted, including government institutions, defence companies, diplomatic bodies and think tanks. Most of the identified targets were in Ukraine and Europe, although the campaign also extended to organisations in other regions.

The importance of the operation lies in the combination of established Russian cyber capabilities with AI-driven automation. The underlying methods — phishing, credential theft, network intrusion and supply-chain compromise — are not new. What has changed is the speed and scale at which they can be deployed, adapted and combined, potentially allowing relatively small teams of operators to conduct work that previously required larger groups of specialised personnel.

Ukraine’s defence industry at the centre

Ukraine’s defence-technology sector was one of the most significant areas of interest. Russian operators targeted companies involved in the production of drones and their components, as well as organisations developing military unmanned systems and related technologies. Their objectives included gaining access to software, engineering information, supply-chain data and other material that could reveal how Ukrainian defence technologies are being developed and deployed.

In one case, the attackers obtained a complete software package connected to a Ukrainian drone computer-vision system. They then spent days analysing its architecture, hardware components, supply chains and information about a product that had not yet been publicly released. Their attention also extended to drone-control systems and firmware associated with AI-based computer vision.

The choice of targets reflects the growing strategic importance of Ukraine’s defence-tech sector. Since the beginning of Russia’s full-scale invasion, Ukrainian companies have rapidly developed new approaches to drones, electronic warfare, battlefield software and autonomous systems. Much of this innovation has emerged directly from battlefield requirements, creating a defence ecosystem capable of adapting technologies at a speed that traditional military procurement systems often struggle to match.

That experience has also made Ukrainian defence technology increasingly relevant to Europe. European governments are looking to Ukraine not only as a country that needs military support, but also as a source of practical knowledge about drones, electronic warfare and modern battlefield technologies. Intelligence gathered from Ukrainian companies can therefore have value for Russia beyond the immediate war effort, particularly if it reveals technologies that could influence future European defence capabilities.

The target is no longer a single institution

The campaign demonstrates why Russia’s cyber-espionage objectives increasingly extend beyond individual government networks. Access to a defence company can provide technical information; access to a supplier can reveal procurement relationships; access to a communications account can expose the people behind those networks. Together, these fragments can give an intelligence service a much broader picture of an adversary’s capabilities and decision-making.

European countries supporting Ukraine form an increasingly interconnected security ecosystem. Defence manufacturers depend on subcontractors, software providers and logistics companies, while governments rely on private technology infrastructure and communication platforms. This means that a cyber operation does not necessarily have to breach a highly protected government or military system directly to obtain strategically valuable information.

The Russian campaign fits into that model. European government agencies, diplomatic institutions, defence organisations, companies and research bodies were among the targets. The objective was not necessarily to compromise a single critical system, but to gather information across multiple parts of the European security environment.

This approach is particularly relevant as Europe seeks to expand its defence-industrial capacity. Governments across the continent are increasing military spending, expanding domestic production and seeking new suppliers, while companies are developing drones, sensors, software and other technologies at an accelerating pace. The resulting ecosystem is generating more valuable intellectual property and more digital connections — and therefore more potential entry points for foreign intelligence services.

AI is changing the economics of hacking

The most significant aspect of the campaign is not that Russian operators discovered a new hacking technique. It is that AI allowed them to automate substantial parts of the existing process.

Claude was used to assist with reconnaissance, phishing infrastructure, credential-related tasks, malware development and the analysis of stolen information. The model could also help operators work through technical problems during an attack, reducing the amount of manual effort required at different stages of the operation.

This matters because sophisticated cyber campaigns have traditionally depended on teams with different areas of expertise. Reconnaissance, vulnerability research, malware development, network intrusion, credential harvesting and data analysis each require specialised knowledge. AI does not eliminate the need for human expertise, but it can allow a smaller number of operators to perform more of these tasks simultaneously.

The result is a shift in the economics of cyber operations. The cost of launching a campaign against a large number of potential targets can fall if AI systems can perform repetitive research, analyse technical information and generate or modify code. Attackers can spend more time deciding where to concentrate their efforts while delegating much of the technical workload to machines.

For European defenders, this creates a difficult asymmetry. Security teams can no longer assume that disrupting one tool or blocking one attack will necessarily stop an operation. If an adversary can rapidly modify its code or generate alternative approaches, the defensive cycle becomes shorter and more demanding.

AI can adapt to the defender

One of the most revealing elements of the operation was the use of AI to respond to defensive measures. When security software detected malicious components, the attackers could use AI to analyse why the code had been identified, modify it and prepare another version for deployment.

This creates a feedback loop between attack and defence. Traditionally, a cyber operator might have to stop an operation, determine why a tool had been detected, rewrite parts of the code and test it again. With AI assisting throughout that process, the time between detection and adaptation can be significantly reduced.

The implications extend beyond Russia. If similar capabilities become widely available, the barrier to conducting sophisticated cyber operations could fall for state and non-state actors alike. A technology initially developed to make legitimate software development and information analysis more efficient can also be used to make malicious operations faster and more scalable.

That does not mean AI independently carried out the Russian campaign. Human operators remained responsible for selecting targets, directing the operation and making strategic decisions. The significance lies in the division of labour: humans increasingly decide what they want to achieve, while AI systems can take over larger portions of the technical process needed to achieve it.

The supply chain is becoming a battlefield

The campaign also highlights the growing importance of supply-chain security. Russian operators compromised at least three hotel Wi-Fi providers and obtained administrative credentials, then manipulated DNS records to redirect users’ traffic through infrastructure under their control.

The objective was not simply to compromise the hotels themselves. The infrastructure could be used to collect information about connected devices and identify people who might be valuable targets. Individuals connected to Ukraine, including government officials and drone manufacturers, were among those of interest.

The tactic illustrates a broader problem for European security. Organisations often invest heavily in protecting their own networks while having much less control over the cybersecurity of external providers. Yet an attacker can use a less protected service as an intermediary and potentially gain information about the people and organisations that use it.

This is particularly challenging in Europe because critical activities increasingly depend on complex networks of private companies. Defence firms rely on technology providers, governments use commercial cloud and communications infrastructure, and officials travel through hotels and other public networks. The boundaries between civilian and strategic infrastructure are becoming increasingly difficult to define from a cyber-security perspective.

Private communications offer a different kind of intelligence

The Russian campaign also targeted WhatsApp accounts belonging to former senior Ukrainian officials. Attackers used automated browser infrastructure to connect compromised accounts as additional devices and extract large volumes of correspondence.

Access to private communications can be particularly valuable for an intelligence service because it provides information that is rarely available through official documents alone. Messages can reveal personal networks, informal relationships, sources, plans and the discussions surrounding decisions before they become formal policy.

This can complement information obtained from government systems or corporate networks. A compromised email account may show what an organisation has decided, while private conversations can help reveal why a decision was made and who influenced it.

For Ukraine and its European partners, the threat therefore extends beyond conventional data theft. Cybersecurity increasingly involves protecting the networks of relationships through which political, military and business decisions are made.

Russia’s existing cyber capabilities give AI a force multiplier

The effectiveness of AI in this campaign cannot be separated from Russia’s existing cyber and intelligence infrastructure. Russian state-backed groups have spent years developing expertise in social engineering, network intrusion, credential theft and the targeting of governments and critical infrastructure.

AI adds a new layer to that established capability. It can process large amounts of information, help identify patterns, accelerate technical development and allow operators to manage more targets without a proportional increase in personnel.

This distinction is important. The strategic advantage does not come from AI acting independently, but from combining AI with experienced intelligence operators who already know how to select targets and exploit compromised information.

The same principle applies to other areas of hybrid activity. Russia has built extensive capabilities in cyber operations, disinformation, espionage and covert influence. More capable AI systems can potentially increase the efficiency of several of these activities by reducing the time and resources needed to produce tailored content, analyse information or identify potential targets.

Europe’s defence build-up creates new intelligence targets

The timing is significant for Europe’s defence sector. European governments are increasing defence budgets, expanding domestic production and seeking to reduce dependence on external suppliers. The war in Ukraine has accelerated investment in drones, electronic warfare, artificial intelligence, battlefield communications and autonomous systems.

This expansion creates strategic opportunities for European industry, but it also creates a growing intelligence target for Russia. Information about new production lines, suppliers, components, software and procurement plans can provide Moscow with a clearer picture of how European defence capabilities are evolving.

Ukraine is an especially valuable source of information because its military industry is developing under real battlefield conditions. Ukrainian companies can test technologies against a technologically capable adversary and rapidly incorporate lessons from combat. Russian intelligence therefore has an incentive to monitor not only what Ukraine is producing today, but also the technologies that could shape the next generation of European warfare.

The same information can also have direct military value for Russia. Understanding the software and components used in Ukrainian systems can help identify vulnerabilities, develop countermeasures or anticipate how particular technologies might evolve.

The boundary between cyber-espionage and military competition is disappearing

The campaign illustrates a broader shift in the nature of European security competition. Cyber-espionage is no longer limited to stealing diplomatic documents or compromising government email accounts. It increasingly targets the technological foundations of military power.

Software, engineering data, production processes and supplier relationships can be as strategically important as traditional military intelligence. As modern armed forces become more dependent on software and networked systems, access to the digital layer behind a weapon can provide information about how that weapon works, how it can be disrupted and how it may evolve.

This is particularly visible in the drone sector. Unmanned systems have become one of the fastest-moving areas of military technology, with Ukraine developing and adapting them at a pace driven by battlefield necessity. The technology race around drones is therefore also becoming an intelligence race.

The Russian campaign shows that Moscow is attempting to participate in that race through cyber means, seeking information that could help it understand and potentially counter Ukraine’s technological advantage.

AI is widening the hybrid threat

The use of AI in cyber-espionage is part of a broader transformation in hybrid warfare. Artificial intelligence can help actors move faster between reconnaissance, information gathering, cyber intrusion and analysis, while reducing the human resources required to coordinate complex campaigns.

Anthropic has also identified AI misuse linked to military applications, surveillance and influence operations involving actors from several countries. The broader trend suggests that the strategic value of AI is no longer limited to economic productivity or civilian applications. Governments and intelligence services increasingly see advanced models as tools that can be integrated into existing security and military capabilities.

For Europe, this creates a policy challenge. Restricting access to AI models can reduce some forms of misuse, but it cannot eliminate the underlying demand for these capabilities. State actors can develop their own systems, use open-source models or attempt to exploit commercial platforms.

The more durable response therefore involves strengthening the entire security ecosystem around AI: model providers need stronger abuse detection, while governments, companies and critical infrastructure operators need to assume that increasingly automated attacks will become part of the threat environment.

A new contest over technology and information

The Russian operation demonstrates that the next stage of the cyber conflict will not be defined simply by more sophisticated malware. The more consequential change is the ability to combine existing intelligence capabilities with AI systems that can automate large parts of the operational process.

For Ukraine, that makes the defence-tech sector a particularly important security asset. Protecting the software, engineering data and supplier networks behind drones and other military technologies is becoming as important as protecting government databases.

For Europe, the implications are broader. The continent is building a larger and more interconnected defence-industrial base at the same time as Russia is seeking ways to penetrate the networks supporting it. The companies producing weapons and technologies, the suppliers providing their components and the digital infrastructure connecting them are increasingly part of the same strategic target set.

AI does not fundamentally change what Russia wants to learn about Europe. It changes how efficiently Moscow can try to obtain that information. The combination of experienced intelligence operators, established cyber infrastructure and increasingly capable AI tools gives Russia another way to scale its activities without necessarily expanding its human workforce at the same rate.