Hackers are targeting Russian companies by masking malicious web requests as traffic from AI services including ChatGPT, DeepSeek, Claude, Perplexity, and Grok. Experts from Solar WAF identified this trend by monitoring web applications between January 2024 and August 2026.
The attackers modify the User-Agent field in HTTP requests to mimic legitimate AI bots. The first requests disguised as DeepSeekBot were recorded on August 12, 2026, followed by other AI-related identifiers on August 27, 2026. This tactic exploits the tendency of businesses to treat AI traffic as valuable customer engagement.
Data shows that 53% of these attacks utilized DNS Rebinding to compromise internal infrastructure. Other methods included data leakage attempts at 12%, Path Traversal at 4%, and various other techniques accounting for the remaining 31%.
In July 2026, Russian companies faced a record 417 million web attacks, a 41% increase compared to July 2025. The transport and logistics sector bore the brunt of these incidents, accounting for 71% of the total, followed by the public sector at 15% and IT at 8%.
