The UK Ukraine AI partnership will give Britain access to Ukraine’s Avengers AI Labs, bringing together Ukrainian battlefield experience, operational data and engineering expertise with the UK’s AI ecosystem. The agreement, signed by President Volodymyr Zelenskyy and Prime Minister Andy Burnham in Ukraine, will focus initially on defence and national security. Under the partnership, British innovators and researchers will gain access to data and insights collected across the battlefield. The UK government described Avengers AI Labs as a “goldmine of battlefield data,” offering researchers access to real-world operational information used to train AI models.

How Avengers AI Labs Uses Battlefield Data

The data is collected through thousands of daylight cameras and infrared sensors deployed across the battlefield. The systems capture images and information involving tanks, artillery, air defence systems, infantry and aerial targets, including Shahed drones and reconnaissance UAVs. The data is used to train AI models to recognize and classify battlefield objects. Ukraine’s Defense Ministry has previously said that systems trained using the Avengers Labs platform analyze more than 100,000 drone video feeds each month and help identify about 70% of enemy targets in real time. The UK’s access to the platform is intended to allow British startups, researchers and engineers to work with operational insights and develop technologies based on real-world datasets. The partnership will initially bring together engineers, academics, businesses and military operational expertise from both countries to address national security challenges. The two countries will also explore additional platforms for future collaboration.

UK Ukraine AI Partnership Test New Defence Technology

Several pilot projects involving British startups have already been rolled out as part of the agreement. The companies named are Bristol-based Sintela, Oxford’s Mind Foundry and London’s Skyral. The first technology is due to be deployed at a UK defence site to help protect bases from protestors and hostile actors seeking intelligence. The project combines Ukrainian data with UK technology and turns buried fibre-optic cables into an AI-enabled sensor. The technology could also be used in other critical locations, including airports, prisons, railways and energy plants, according to the information released about the partnership. A second project will examine the development of next-generation low-power AI chips designed for future drones, robotics and autonomous systems. If successful, the technology could support machines designed to operate for longer, respond faster and function in environments where conventional systems face limitations.

AI Sovereignty and Defence Innovation

The agreement forms part of the UK and Ukraine’s 100 Year Partnership and expands cooperation between the two countries in AI and defence technology. The UK will provide access to its universities, researchers, technology companies and AI ecosystem, while Ukraine will provide access to operational experience and datasets generated during the war. Minister for AI Kanishka Narayan described the arrangement as AI sovereignty in practice, focused on developing national capabilities and turning frontline experience into technologies for military and critical infrastructure protection. The partnership also follows the UK government’s announcement that defence firm MBDA can release classified information on UK components for the long-range SCALP missile to establish local assembly lines in Ukraine. The broader agreement is intended to combine Ukrainian battlefield data with British scientific, engineering and technology expertise, with the initial focus remaining on defence, national security and the development of future defence technology.

A suspected ARMA cyberattack has targeted Ukraine's Asset Recovery and Management Agency as it prepares to select a manager for assets linked to IDS Ukraine. ARMA said its servers experienced unauthorized interference ahead of the August 22 deadline for applications, prompting an investigation into whether the incident was part of a broader effort to disrupt its operations. The Asset Recovery and Management Agency, known as ARMA, manages assets seized by Ukrainian authorities, including assets linked to sanctioned Russian individuals and alleged collaborators with Moscow.

ARMA Cyberattack Raises Questions Over IDS Ukraine Competition

ARMA said the attack occurred shortly before the August 22 deadline for applications to participate in the competition to select a manager for assets controlled by sanctioned Russian oligarch Mikhail Fridman. The agency said its experts and law enforcement authorities are examining the cyberattack and the events surrounding the IDS Ukraine competition. The Security Service of Ukraine, or SBU, is investigating the recent attack, while a broader National Anti-Corruption Bureau of Ukraine, or NABU, investigation is examining earlier alleged interference. According to ARMA, signs of illegal interference in processes connected to its work have been recorded since spring. These included unauthorized access to the agency's officials' register. ARMA said the combination of cyber incidents, information activity and increased inquiries from some media outlets and members of parliament had raised concerns about a possible coordinated campaign. The agency said investigators must determine whether these events were intended to disrupt its work, create pressure or affect the competition. ARMA has not identified those it believes may have organized or carried out the alleged campaign.

IDS Ukraine Selection Continues Despite Cyberattack

Despite the incident, ARMA said the competition to select the IDS Ukraine asset manager will proceed according to the procedures and timeframe established by law. The deadline for applications is August 22, 2026, with the competition announcement published through Ukraine's Prozorro public procurement system. The agency said it has also started an audit of the financial indicators of seized IDS group assets to support the legality, objectivity and transparency of the transfer process. ARMA said additional information concerning possible unauthorized access to officials' email accounts and official information will be provided to law enforcement authorities for investigation and legal assessment. Acting ARMA Head Yaroslava Maksymenko said the agency would continue the competition despite what it described as information pressure, political interference and attempts to gain unauthorized access to its resources.

Ukraine Investigates Possible Coordinated Interference

ARMA said the latest incident is not being viewed in isolation. The agency pointed to a similar episode earlier this year, when Reuters reported on a cyberattack involving attempts at interference and hacking alongside increased information activity and inquiries. The agency said each event could have an individual explanation, but their timing and combination warranted further investigation. The cyberattack comes as Ukraine continues efforts to prevent sanctioned Russian capital from retaining control over assets seized in the country. ARMA said this includes preventing control through management arrangements, intermediaries or influence groups. Fridman has been sanctioned by Ukraine and several Western governments since Russia's invasion. ARMA said the final responsibility for determining the organizers, customers and perpetrators of the attack rests with the ongoing investigations. The agency said it will continue the IDS Ukraine competition and act within the law while law enforcement agencies examine the reported cyber incidents and possible attempts to interfere with its activities.

The National Police of Ukraine has disclosed an international cybercrime operation tied to the theft of nearly 30,000 customer accounts belonging to a California-based online retailer, authorities said this week. According to Ukraine’s Cyber Police Department, investigators identified an 18-year-old resident of Odessa who allegedly played a key role in a large-scale account theft scheme involving stolen session data, malicious software, and unauthorized online purchases that caused millions of hryvnias in losses. The investigation was conducted by cyber police officers in the Odessa region and the Main Investigation Department of the National Police under the procedural guidance of the Prosecutor General’s Office. Ukrainian authorities said the operation was carried out in cooperation with US law enforcement agencies through international legal assistance mechanisms. [caption id="attachment_112203" align="aligncenter" width="817"] Image Source: Cyber ​​Police Department, National Police of Ukraine[/caption]

Account Theft Scheme Targeted Thousands of Online Store Users

Investigators said the account theft scheme operated throughout 2024 and 2025 and targeted customers of an online store based in California. According to law enforcement officials, attackers gained unauthorized access to more than 28,000 customer accounts. At least 5,800 compromised accounts were later used to make fraudulent purchases worth approximately $721,000. Authorities estimated the resulting financial damage, including chargebacks and related losses, exceeded $250,000, or roughly 11 million Ukrainian hryvnias. Officials believe the cybercriminal group relied heavily on infostealer malware to compromise victims’ devices and collect sensitive login credentials.

Infostealer Malware Used to Steal Session Data

Investigators said attackers deployed malicious software commonly known as “infostealers” to secretly infect users’ devices. The malware was designed to harvest:

• Login credentials
• Session cookies
• Authentication data
• Browser-stored information

Once collected, the stolen information was transmitted to infrastructure controlled by the attackers. Law enforcement officials said the data was later processed, organized, and sold through specialized underground online platforms and Telegram bots frequently used by cybercriminal communities. Cybersecurity experts have repeatedly warned about the growing use of infostealer malware in credential theft campaigns because stolen session tokens can sometimes allow attackers to bypass passwords and authentication mechanisms. The investigation suggests the stolen session data became a central component of the broader account theft scheme uncovered by Ukrainian authorities.

Odessa Resident Accused of Managing Criminal Infrastructure

During the investigation, police identified an 18-year-old suspect from Odessa who allegedly managed parts of the online infrastructure used in the cybercrime operation. According to authorities, the suspect administered systems connected to:

• Processing stolen session data
• Selling compromised credentials
• Managing access to stolen accounts
• Supporting transactions involving cryptocurrency

Investigators also alleged that cryptocurrency services were used to conduct financial settlements between members of the cybercriminal network. Ukrainian law enforcement officers conducted two searches at the suspect’s residence, where they seized multiple digital devices and other evidence connected to the case.

Police Seize Digital Evidence in Cybercrime Investigation

During the searches, authorities confiscated:

• Mobile phones
• Computer equipment
• Bank cards
• Electronic storage devices
• Cryptocurrency exchange account information

Investigators said they also discovered access credentials linked to platforms used for selling stolen data, email accounts associated with compromised customer profiles, and server activity logs connected to the cybercrime operation. Officials stated the seized evidence further confirmed the suspect’s alleged involvement in the account theft scheme and broader illegal cyber activities. The investigation remains ongoing as authorities continue working to identify additional individuals connected to the operation.

Growing Threat of Infostealer Attacks

The latest case highlights the increasing global threat posed by infostealer malware and account takeover operations targeting online platforms and e-commerce services. Cybercriminal groups are increasingly using credential-stealing malware to harvest browser data and session information from infected devices. Stolen credentials are then sold through underground marketplaces or used directly for financial fraud, identity theft, and unauthorized purchases. Security researchers have also warned that Telegram-based cybercrime services are making stolen credentials and malware distribution more accessible to lower-skilled attackers. The operation uncovered by Ukrainian authorities reflects how international cybercrime networks continue exploiting compromised accounts, cryptocurrency infrastructure, and underground data markets to carry out financially motivated attacks across borders.

Ukrainian cyber defenders reported a newly intensified cyber campaign that is targeting Ukraine’s healthcare system and local government agencies, with attackers deploying increasingly sophisticated malware and social engineering tactics.

In a fresh advisory, the CERT-UA said the activity—linked to a threat cluster tracked as UAC-0247—spiked between March and April 2026, with clinical hospitals, emergency services, and municipal bodies bearing the brunt of the attacks.

UAC-0247 Used Humanitarian Aid Lures as Entry Point

The campaign begins with phishing emails disguised as offers of humanitarian assistance—a tactic designed to exploit trust during wartime conditions. Victims are urged to click on links that appear legitimate, sometimes backed by convincingly crafted fake websites or compromised third-party resources.

Behind the scenes, however, the links trigger a multi-stage infection chain that ultimately gives attackers remote control over the victim’s system.

Once clicked, victims download an archive containing a malicious shortcut file. This file activates a built-in Windows tool to execute remote code, initiating a sequence that includes decoy documents to avoid suspicion.

Also read: Hackers Impersonate Ukrainian CERT to Plant a RAT on Government, Hospital Networks

The attack escalates quickly. Malicious executables are deployed via scheduled tasks, injecting code into legitimate system processes such as RuntimeBroker.exe to evade detection.

Recent campaigns show an evolution in sophistication, with attackers introducing multi-stage loaders and custom executable formats. Payloads are often encrypted and compressed, making analysis and detection more difficult.

At later stages, attackers deploy reverse shell tools—including variants resembling “RAVENSHELL”—to establish encrypted communication with command-and-control servers and execute remote commands.

Persistent Access and Remote Control

To maintain long-term access, attackers install a custom backdoor known as AGINGFLY, a C#-based malware designed for full remote system control. The tool enables:

• Command execution
• File exfiltration
• Screenshot capture
• Keylogging

Unlike conventional malware, AGINGFLY dynamically retrieves and compiles its command logic from remote servers, making it more adaptable and harder to detect.

Complementing this is a PowerShell-based tool dubbed SILENTLOOP, which helps maintain persistence and retrieves command server addresses—sometimes even pulling them from Telegram channels.

Credential Theft and Lateral Movement

Once inside a network, attackers move quickly to expand access. CERT-UA observed tools like CHROMELEVATOR being used to extract browser credentials, while ZAPIXDESK targets WhatsApp data.

The attackers also conduct internal reconnaissance using both custom scripts and publicly available tools such as RUSTSCAN. For stealthy movement across networks, tunneling tools like LIGOLO-NG and CHISEL are deployed.

In at least one case, attackers went further—embedding the XMRIG cryptocurrency miner inside a modified version of the legitimate WireGuard application, highlighting a secondary motive of financial gain.

Military Targets Also in Scope

The campaign isn’t limited to civilian infrastructure. CERT-UA noted an incident in March where individuals connected to Ukraine’s defense sector were targeted via the Signal platform.

Attackers distributed a trojanized version of software used by FPV drone operators, packaged as a seemingly legitimate update. In reality, the download triggered a DLL side-loading attack that installed the AGINGFLY backdoor.

CERT-UA recommends reducing exposure by restricting the execution of high-risk file types such as LNK, HTA, and JavaScript files. The agency also urges organizations to limit the use of native Windows tools like mshta.exe and PowerShell where possible, as these are frequently abused in attacks.