Deepfake Cyber Attacks: Emerging Threats in Eastern Europe

Introduction

In early 2026, ransomware groups in Eastern Europe have been observed integrating deepfake technologies into their cyberattack strategies. This evolution signifies a medium-level threat, as these groups employ deepfake video and audio for social engineering, synthetic identity operations, AI-generated phishing media, and Business Email Compromise (BEC) fraud via deepfake voice calls.

Deepfake Integration in Ransomware Operations

Ransomware groups, such as the previously active DarkSide, have historically targeted organizations with ransomware attacks. Recent intelligence indicates a shift towards incorporating deepfake technologies to enhance the effectiveness of their operations. By leveraging AI-generated media, these groups can create highly convincing impersonations of trusted individuals, thereby increasing the success rate of their attacks.

Social Engineering and Synthetic Identity Operations

Deepfake videos and audio are utilized to impersonate executives, colleagues, or clients, facilitating social engineering attacks. For instance, attackers may create a deepfake video of a CEO instructing a subordinate to transfer funds urgently, exploiting the trust inherent in the relationship. This tactic has been linked to significant financial losses, as seen in previous incidents where AI-generated deepfakes led to substantial unauthorized transactions. (forbes.com)

AI-Generated Phishing Media

The use of AI to generate phishing emails has become prevalent, with 83% of phishing emails now incorporating AI, and 40% of BEC attacks utilizing generative AI. These AI-generated emails boast a 54% click rate due to improved grammar, personalization, and timely content, compared to just 12% for traditional phishing messages. (itpro.com) This advancement makes it increasingly challenging for traditional security measures to detect and prevent such attacks.

BEC Fraud via Deepfake Voice Calls

Deepfake voice cloning has emerged as a significant threat, with cybercriminals using AI to replicate the voices of trusted individuals. This technique has been employed to deceive employees into authorizing fraudulent transactions. For example, a bank manager was tricked into transferring $35 million after receiving a call from a deepfake of a company director. (forbes.com) Such incidents underscore the need for organizations to implement robust verification protocols to mitigate the risk of deepfake voice fraud.

Mitigation Strategies

To counteract the threat of deepfake cyberattacks, organizations should consider the following measures:

• Employee Training: Educate staff on the risks associated with deepfake technologies and the importance of verifying requests for sensitive information or financial transactions.

• Multi-Factor Authentication (MFA): Implement MFA to add an additional layer of security, making it more difficult for attackers to gain unauthorized access.

• Advanced Detection Tools: Utilize AI-powered tools capable of detecting deepfake content to identify and block fraudulent communications.

• Incident Response Planning: Develop and regularly update incident response plans to address potential deepfake-related security breaches promptly.

Conclusion

The integration of deepfake technologies by ransomware groups in Eastern Europe represents a significant evolution in cyberattack methodologies. While the current threat level is medium, the potential for increased sophistication and frequency of such attacks necessitates proactive measures from organizations to safeguard against these emerging threats.

Highlights:

• 'Verify before you act': security expert reveals the simple steps you can take to stay safe from deepfakes, Published on Tuesday, April 07
• Deepfake worries hit a new high as one in four Americans say they have received a deepfake voice call in the past 12 months - experts blame 'the weaponization of AI', Published on Saturday, March 14
• 'AI-generated phishing became the baseline' for hackers last year - Kaseya warns it's going to get worse in 2026, Published on Thursday, March 19