Ledger / 8 Sep 2026

SANDWORM RELIC integrated Gemini into operations against Ukraine

Confirmed

Google observed the activity.

The group used Gemini for intelligence gathering, social engineering and workflow automation.

“has integrated Gemini to support intelligence gathering, social engineering, and workflow automation in continued operations targeting Ukraine”Google Threat Intelligence Group

Sources

GTIG AI Threat Tracker: From Prompting to AutonomyGoogle Threat Intelligence Group · 8 Sep 2026 · primary source

Disclosed: 8 Sep 2026
Activity: 2026
Actor: SANDWORM RELIC (APT44) (nation state), as attributed by Google Threat Intelligence Group
Nexus: Russia
Targets: Ukraine
What the AI did: Recon, Social engineering, Ops automation
Model: Gemini
Model family: Google
Model basis: stated by vendor
Autonomy: assist
Outcome: Google reports.

← Exposed 'Recon' framework used AI agents to harvest 23,800 secretsShinyHunters cluster UNC6240 used AI across SaaS extortion attacks →