Emerging Threat: APT Groups Exploit Deepfake Technology in Cyber Attacks

Introduction

Advanced Persistent Threat (APT) groups are increasingly leveraging deepfake technology to enhance cyber attacks, particularly in Eastern Europe. Deepfakes—synthetic media generated or altered using artificial intelligence (AI)—pose significant challenges to traditional cybersecurity measures. This briefing examines recent developments and provides strategic recommendations for organizations to mitigate these emerging threats.

Deepfake Technology in Cyber Attacks

Deepfakes utilize AI algorithms to create hyper-realistic videos, audio, and images, making it challenging to distinguish between authentic and manipulated content. In the cyber threat landscape, APT groups employ deepfakes in various malicious activities:

• Social Engineering Attacks: By impersonating trusted individuals through deepfake videos or audio, attackers can deceive employees into divulging sensitive information or performing unauthorized actions.

• Synthetic Identity Operations: Deepfakes enable the creation of convincing fake identities, facilitating fraudulent activities such as unauthorized access to systems or financial accounts.

• AI-Generated Phishing Media: Attackers craft realistic phishing emails or messages using deepfake technology to increase the likelihood of successful deception.

• Business Email Compromise (BEC) via Deepfake Voice Calls: Deepfake voice technology allows attackers to mimic the voices of executives or trusted contacts, leading to fraudulent financial transactions or data breaches.

Case Studies

Recent incidents highlight the growing use of deepfakes by APT groups:

• Kimsuky Group's Military ID Fraud: In July 2025, the Kimsuky group, attributed to North Korea, employed generative AI tools to create deepfake images of South Korean military ID cards. These images were used in spear-phishing attacks targeting defense-related institutions, aiming to gain unauthorized access to sensitive information. (genians.co.kr)

• Chollima APT's Infiltration of Crypto Companies: In November 2025, the Chollima APT group utilized real-time AI deepfakes during video interviews to impersonate qualified job candidates. This tactic was employed to infiltrate cryptocurrency and Web3 companies, highlighting the use of deepfakes in social engineering and corporate espionage. (socradar.io)

Implications for Eastern Europe

Eastern Europe, with its rapidly digitizing economies and significant presence of critical infrastructure, is particularly vulnerable to deepfake-driven cyber attacks. The region's geopolitical landscape and ongoing conflicts make it a prime target for APT groups seeking to disrupt operations, steal sensitive information, or influence public perception.

Strategic Recommendations

To mitigate the risks associated with deepfake technology, organizations should consider the following strategies:

1. Employee Training and Awareness: Regularly educate staff on the risks of deepfake attacks and establish protocols for verifying the authenticity of communications.

2. Implement Multi-Factor Authentication (MFA): Enhance security measures by requiring multiple forms of verification, reducing the likelihood of unauthorized access.

3. Deploy Deepfake Detection Tools: Utilize AI-driven tools capable of identifying manipulated media to detect and prevent deepfake-related threats.

4. Establish Clear Communication Protocols: Develop and enforce procedures for verifying requests for sensitive information or financial transactions, including secondary confirmations through alternative channels.

5. Monitor and Analyze Threat Intelligence: Stay informed about emerging deepfake techniques and APT group activities to proactively adjust defense strategies.

Conclusion

The integration of deepfake technology into cyber attack methodologies by APT groups represents a significant evolution in the threat landscape. Organizations in Eastern Europe must adopt comprehensive strategies to detect, prevent, and respond to these sophisticated attacks. By enhancing awareness, implementing robust security measures, and fostering a culture of vigilance, organizations can better safeguard against the evolving threat posed by deepfakes.

Highlights:

• Deepfake worries hit a new high as one in four Americans say they have received a deepfake voice call in the past 12 months - experts blame 'the weaponization of AI', Published on Saturday, March 14
• AI impersonation scams are sky-rocketing in 2025, security experts warn - here's how to stay safe, Published on Sunday, August 31
• Militant groups are experimenting with AI, and the risks are expected to grow, Published on Sunday, December 14