Pro-Ukrainian hackers use AI-generated decoy documents to infiltrate Russian defence industry

A pro-Ukrainian cyber-espionage group leveraged AI to craft realistic fake documents that were used to infiltrate Russian defence contractors in an effort to gain sensitive information. What happened Several Russian defence and technology companies were targeted by a cyber-espionage campaign that used AI-generated documents as social-engineering tools to gain unauthorised access and extract information. These "decoy" documents included fake invitations in Russian to events and communications purportedly from the Russian Ministry of Industry and Trade, in order to entice employees at defence firms to open them. The operation is attributed to a hacking collective known within the cybersecurity community as “Paper Werewolf” or GOFFEE, an actor that has been active since at least 2022 and generally focuses its operations on Russian targets. The activity was uncovered by analysts at cybersecurity firm Intezer, which publicly disclosed the findings through Reuters and other outlets. Why it happened The campaign appears motivated by the ongoing conflict between Russia and Ukraine, with pro-Ukrainian aligned actors seeking strategic advantage through intelligence collection on critical defence supply chains, research processes and military industry operations. The use of AI tools to generate convincing decoy documents illustrates how accessible generative technologies have been repurposed for sophisticated cyber-espionage. These tools lower the bar for creating credible, targeted social-engineering lures. The fact that publicly available AI systems can be used to produce high-quality forgeries underscores broader challenges in cyber-defence linked to technology misuse. Wh at it means For the intended victims. It is unclear whether the attack successfully resulted in the theft of confidential documents. However, it will have sent a message that these kinds of operations can potentially degrade operational security. System 🤖 Unknown Developer: Country: Russia Sector: Govt - defence Purpose: Create fake documents Technology: Generative AI Issue: Security Investigations, assessments, audits 👁️ Intezer. Tracing a Paper Werewolf campaign through AI-generated decoys and Excel XLLs

Date it happened

2025-01-01

Organisation involved

Pro-Ukraine hackers

This is a record of what was reported, not a finding that anyone broke the law. If it names your organisation and you believe it is wrong, the corrections process is free and open to everyone.