“It will not be as before”: Ukrainian veterans are creating their own AI solutions amid a new wave of cyberattacks

The Ukrainian digital space has received another serious warning.

According to the State Service of Special Communications and CERT-UA, more than 100 compromised web resources on which attackers placed malicious code were detected in September alone.

Users could be shown a fake Cloudflare page with an “I am not a robot” check, after which the person was asked to run a certain command themselves via Windows system tools.

In effect the user was made to launch the mechanism that infects their own computer with their own hands.

The particular danger of such attacks is that the owner of a web resource may not even suspect the compromise for a long time. A malicious script may activate only for a certain category of users, operating systems or referral sources, or under certain conditions.

That is, the site may look perfectly normal to the administrator while already being a source of threat for the customer.

“We are entering an era when a site can work — and at the same time already be dead”

The President of the International Technology Transfer Association (ITTA), PhD Artem Honcharenko, believes such cases demonstrate a far bigger problem than one particular wave of cyberattacks.

“It will not be as it was before. Business is used to judging a site very simply: it opens, so it works. There is SSL, so it is protected. There is a backup, so everything is under control. That model is over. Today a site can open, accept enquiries and look completely normal — and at the same time already be working for the attacker.”

Artem Honcharenko, PhD, ITTA President

According to Artem Honcharenko, technological development at once creates opportunities for business and sharply increases the speed of potential attacks.

That is precisely why, the ITTA president stresses, the question of technological independence and in-house development is gradually moving from the category of economic competitiveness to the category of security.

“Artificial intelligence has given us the ability to automate millions of operations, but the other side has got the same technologies. Attacks are becoming faster, cheaper, more scalable and much better disguised. A person physically cannot control such a volume of events by hand. So the answer to machine-speed attack must be machine-speed analysis and response.”

“For Ukraine it is critically important to stop being merely a consumer of ready-made technology. We must create our own AI products, our own monitoring systems, our own cyber-resilience solutions. And it is extremely important that Ukrainian veterans are actively entering this process. Not as recipients of aid — but as developers, entrepreneurs, systems architects and technology leaders.”

Veterans are creating their own technology

One of the platforms for such a transition has been the AI incubator of the Veterans Cluster of Ukraine.

Its concept is not just training in working with ChatGPT or other ready-made services.

The incubator is geared to creating applied AI solutions: from analysing business processes and prototyping to integrating the product and using it in a real operating environment.

Within the ecosystem, solutions are being developed for working with documents, business-process automation, AI assistants, analytics, integration of information systems and promising tools in digital security.

Coordinator of the Veterans Cluster AI incubator and IT expert Mykhailo Vasianovych explains that modern cyber defence increasingly resembles looking for a single anomaly in a huge array of entirely normal events.

“The main problem is no longer finding a known virus by a ready-made signature. The real task is to spot, among millions of normal requests, a few events that behave differently from how they should. A different JavaScript, an unusual sequence of requests, a change in page behaviour for a specific user, an atypical traffic source — sometimes a major compromise begins with just such small things.”

Mykhailo Vasianovych, coordinator of the Veterans Cluster AI incubator, IT expert

According to Mykhailo Vasianovych, the team is working on an architecture able to analyse high-load information flows with the help of AI.

At the same time, in his words, this is not about one universal “magic antivirus”.

“We are building an approach designed to analyse arrays of millions of requests and digital events a minute. A person cannot physically review such a flow. AI can. But its task is not to replace the cybersecurity specialist but to find the anomaly as fast as possible, determine the level of risk and give the specialist the chance to respond before the incident turns into a catastrophe.”

“We need a multi-level architecture. Traffic monitoring, change control, behaviour analysis, work with logs, detection of atypical scenarios, integration with existing security systems. AI is not a single button. It is a new analytical layer that lets you work at speeds and volumes a human cannot.”

A site can be infected even if you do not see it

The new wave of attacks is especially telling precisely because of the mechanics of compromise.

The site can remain available. The administrator may see its normal version. Customers can keep placing orders. The search engine can keep showing the pages in search results.

But some visitors, under certain conditions, will already be getting different content.

For Artem Honcharenko this changes the very definition of digital reliability.

That is why his forecast for business is rather harsh:

“A dead site is no longer necessarily a page with a 404 error. A site can become dead for business if customers have stopped trusting it, if it spreads malicious code, has been blocked by browsers, has lost its search traffic or has become an entry point into corporate infrastructure. It technically still exists — but as a business asset it has effectively been destroyed.”

“By the end of the year we will see an increasingly clear split into two categories. The first will start treating a site as full digital infrastructure that must be constantly monitored and protected. The second will go on treating it as a brochure on the internet that was made once and forgotten. The second model has practically no future. Either change — or one day your site will die much faster than you manage to understand what happened.”

AI changes not only the attack — it changes the defence system itself

Previously a large number of cyber operations required substantial human resources.

Today automation makes it possible to test thousands of web resources at once, look for vulnerabilities, change social-engineering scenarios, generate content and quickly rebuild infrastructure.

Hence the traditional model, in which an administrator occasionally logs in to the site, updates plugins and looks through event logs, is becoming insufficient.

“We are no longer talking about an administrator fighting a lone hacker. We are talking about automated systems against automated systems. Whoever saw the anomaly faster, understood its context faster, reacted faster — has the advantage.”

Mykhailo Vasianovych

Veteran Tech as a new sector of the Ukrainian economy

For the Veterans Cluster of Ukraine the AI incubator has one more fundamental function.

It demonstrates an alternative approach to veterans policy.

A veteran need not only be someone to whom the state or business offers retraining. He can create technology himself. He can build a company. He can develop a product. He can enter the international market. He can shape solutions for the civilian economy, the state and the security sector.

Artem Honcharenko calls precisely this approach one of the key ones for post-war Ukraine.

And it is here, in the ITTA president's view, that Ukraine has a potential global advantage.

“We must stop looking at the veteran exclusively through the prism of social support. Among veterans there are a huge number of people with experience of management, of working under risk, of making decisions under pressure, with engineering minds and an understanding of real threats. If you combine this experience with technology, universities, business and international technology transfer, we will get a new sector of the Ukrainian economy.”

“Ukrainian technology is today going through the toughest test in the world — the test of reality. If a solution can work here, under constant physical and digital threats, it can potentially be competitive far beyond Ukraine. Our task is to turn this experience into product, intellectual property, international partnerships and technology export.”

“Do not ask only whether your site works”

More than 100 compromised Ukrainian web resources are not just another entry in the cyber-incident statistics.

It is a signal to business, universities, public organisations, state institutions and owners of digital platforms.

In 2026 the question “Does our site work?” is no longer enough.

The right questions are different: who controls changes to its code? What does a user see from another device? Which third-party scripts are executed? Who analyses anomalies? How quickly will the organisation see a compromise? And how much time will pass between the attack and the response?

“Cybersecurity is ceasing to be a matter for one system administrator. It is a matter for the manager, the business owner and the strategy of the whole organisation. Because today the cost of an unprotected site is no longer repairing a server. It is reputation, customers, data, money and trust.”

Artem Honcharenko

Meanwhile Ukrainian veterans are trying to give their own technological answer to this problem.

Not just using someone else's AI. But creating their own.

Factual basis of the material

• State Service of Special Communications / CERT-UA: report on the mass spread of malware through a fake “I am not a robot” check https://www.kmu.gov.ua/news/ia-ne-robot-cert-ua-fiksuie-masove-poshyrennia-shkidlyvoho-prohramnoho-zabezpechennia
• Microsoft Security: analysis of the ClickFix social-engineering technique https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/
• AI incubator of the Veterans Cluster of Ukraine https://veterano.info/ai-inkubator