Information Warfare — 2026-10-24

FSB or GRU Deploy AI-Powered Agents for Autonomous Cyberattacks Against Ukrainian Networks

BLUFRussia's shift to autonomous AI cyber agents against Ukraine demands that exposed Ukrainian agencies build dedicated security teams and geographic redundancy before physical and digital attacks converge to degrade government services.

A CEPA analysis by Ieva Ilves and Adm. Michael Rogers states that hackers tied to the FSB or the Russian General Staff are using AI agents that move between machines inside Ukrainian networks and report to human operators, who decide whether to steal data, plant malware, or disable services 1. CEPA attributes a 2500% rise in low-severity attacks in the first half of 2026 to AI, with targets including law enforcement, notaries, and medical institutions 1. Prime Minister Serhiy Koretskyi said Russia is increasingly using AI against government information systems and Ukrainian businesses, and ordered all executive agencies to form cybersecurity teams and buy software urgently 23. Koretskyi also said about ten Kyiv data centers were damaged in September, and UA.News reported that strikes on October 19 and 20 hit Datagroup and GigaCenter facilities 2.

Analysis
Russian state-linked operators have moved from using AI for isolated tasks to deploying agents that traverse Ukrainian networks on their own, leaving humans to choose between theft, malware, and disruption. Agencies without dedicated security staff are the exposed layer, which explains the order for every executive body to field teams and buy software urgently. Physical strikes compound the threat: Kyiv data centers were hit in September, then Datagroup and GigaCenter on October 19 and 20, and one Datagroup site cannot be restored. Backup sites kept Datagroup customers online, so redundancy outside Kyiv is the control that matters most for government services. Confidence is high, based on consistent reporting across three outlets and a primary government statement, though the scale of AI-driven attacks rests on a single analytic source. The 2500% rise counts low-severity automated probing, so much of it may reflect scanning noise rather than a gain in Russian capability.

3 sources