AI-Driven Spear-Phishing: A Rising Threat in Eastern Europe

In early 2026, the cybersecurity landscape in Eastern Europe has witnessed a notable escalation in spear-phishing attacks, primarily driven by advanced persistent threat (APT) groups employing artificial intelligence (AI) technologies. These adversaries are utilizing large language models (LLMs) to craft hyper-personalized phishing emails, enhancing the effectiveness and scale of their operations.

AI-Enhanced Phishing Campaigns

APT groups, including Russia-linked APT28 (also known as Fancy Bear or Sofacy), have been observed integrating AI into their cyber-espionage activities. Between late September 2025 and January 2026, APT28 conducted "Operation MacroMaze," targeting Western and Central European entities with spear-phishing emails containing malicious macros. These emails, often disguised as official diplomatic communications, were designed to deceive recipients into enabling macros, leading to the deployment of malware that established persistence and exfiltrated data. (techradar.com)

The incorporation of AI has significantly enhanced the sophistication of these campaigns. AI-generated emails are now more convincing, scalable, and effective, making traditional detection methods less effective. A 2026 report from Kaseya highlights that 83% of phishing emails now incorporate AI, with 40% of business email compromise (BEC) attacks utilizing generative AI. These AI-driven emails boast a 54% click rate due to improved grammar, personalization, and timely content, compared to just 12% for traditional phishing messages. (itpro.com)

Notable Threat Actors and Operations

Chinese-speaking APT groups, such as APT24 and Speccom, have also been implicated in AI-driven spear-phishing campaigns targeting Eastern European sectors. APT24, for instance, employed AI to develop malware like BadAudio, which was delivered through phishing emails and exploited vulnerabilities in legitimate websites. This malware utilized advanced evasion techniques, including DLL sideloading and supply chain attacks, to establish persistence and exfiltrate data. (ics-cert.kaspersky.com)

The use of AI in these campaigns has led to a surge in phishing attacks, with a 204% increase in AI-driven phishing incidents reported in 2025. Organizations are now facing a malicious email every 19 seconds, underscoring the scale and urgency of the threat. (the-european.eu)

Implications and Recommendations

The integration of AI into spear-phishing campaigns represents a significant evolution in cyber threat tactics. Traditional security measures are increasingly inadequate against these sophisticated, AI-enhanced attacks. Organizations must adopt a proactive, AI-driven security posture, incorporating advanced threat detection systems capable of identifying and mitigating AI-generated phishing attempts. Additionally, continuous employee training on recognizing and responding to phishing threats is crucial to bolster human defenses against these evolving tactics.

In conclusion, the rise of AI-driven spear-phishing attacks in Eastern Europe necessitates a comprehensive and adaptive cybersecurity strategy. By leveraging advanced technologies and fostering a culture of security awareness, organizations can enhance their resilience against these increasingly sophisticated threats.