Cybercriminals have moved from manual hacks to self-learning botnets targeting critical infrastructure — from energy to the banking sector. For businesses and investors, this translates into downtime and rising cybersecurity costs; for citizens, it means the threat of disruptions to banking and government services.
This was stated by Evgeny Sysoev, head of the CIS Anti-Terrorism Center (ATC), at the first "SCO Plus" expert dialogue on security. According to his assessment, a fundamental shift has occurred in cyberspace: manual hacker attacks have been replaced by self-learning botnets — networks of infected devices under someone else's control.
Self-learning botnets instead of manual hacks
Using AI, attackers continuously search for gaps in the networks of energy, transport, financial sector, and government administration facilities. The technology allows them to instantly exploit zero-day vulnerabilities that developers don't yet know about and to create polymorphic malicious code. Such programs constantly mutate, so traditional antiviruses simply cannot detect them.
In response, CIS countries have switched their state systems for detecting and eliminating the consequences of computer attacks to proactive defense — advance threat hunting using machine learning. According to Sysoev's assessment, this makes it possible to intercept sophisticated attacks on critical infrastructure before the attackers reach control of the facilities.
The transition of critical infrastructure facilities to domestic software and an electronic component base is proceeding on schedule, at the level of laws and infrastructure. This step eliminates the risk of facilities being disconnected from abroad.
How cyber risks are growing: from the DPRK to Uzbekistan
The use of AI in attacks is already evident in the example of the North Korean group Kimsuky. Genians specialists discovered that the hackers have tools for running language models on their own computers, as well as phishing documents about investments and cryptocurrencies, likely created by a neural network.
AI developers themselves are also raising the alarm. More than 100 companies, including Anthropic, Google, and Microsoft, signed an open letter calling for stronger cybersecurity due to the growth of AI-enabled attacks.
Investors felt the cost of cyber threats in "Black October": four major incidents, including the PHP2Shell vulnerability in the PHP language and the hacking of the Railway cloud platform, occurred within just 48 hours. Kraken and Ledger warned of risks for exchanges and crypto wallets, eMudhra shares plummeted by 20%, while cybersecurity companies rose by 5–7%.
Earlier, Uzbekistan's President Shavkat Mirziyoyev proposed that CIS countries create a joint contact center against cyber fraudsters. It is difficult for a single country to pursue criminals abroad, so Tashkent is calling on its neighbors to join forces.
Cryptalist analysis: The shift of attackers to AI botnets changes the risk structure for the crypto industry: exchanges and custodial services are becoming priority targets, and security spending is turning into a permanent budget line item. The 5–7% rise in cybersecurity company valuations reflects the market's revaluation of the entire information security segment as a defensive asset. For investors, this is a signal to factor cyber risk in as a systemic factor when evaluating infrastructure and financial projects.