WithSecure Details AI-Enabled GreyVibe Campaigns Targeting Ukraine
Summary
WithSecure describes GreyVibe, a Russia-nexus actor targeting Ukrainian entities since August 2025 and using AI across its operations. Phishing and fake-site campaigns deliver Windows and Android malware; a LegionRelay flaw helped researchers track activity.
Key points
- WithSecure describes GreyVibe as a previously undocumented Russia-nexus group targeting Ukrainian military, government, civilian, and business entities since August 2025; the researchers are uncertain whether it is criminal, state-linked, or a mix.
- The researchers say GreyVibe uses AI across its operations, including lure creation, fake websites, malware development, obfuscation, and post-compromise tooling.
- At least six spear-phishing campaigns directed victims to ZIP or RAR archives on file-sharing services; decoys distracted victims while PhantomRelay infection proceeded in the background.
- A separate campaign, PrincessClub, used fake adult-club websites and personas on Telegram or dating sites to deliver Fallspy on Android and PhantomRelay or LegionRelay on Windows.
- Design flaws in the AI-generated LegionRelay Windows malware enabled WithSecure to monitor and track GreyVibe activity over an extended period.
- WithSecure found a unique ISO builder potentially linked to the TrickBot ecosystem and UAC-0098, an activity cluster previously observed targeting Ukraine.
Article Details
- Event Type
- AI-assisted cyberattack campaign involving spear-phishing, fake websites, and malware delivery targeting Ukrainian entities.
- Impact
- WithSecure reports that GreyVibe has targeted Ukrainian military, government, civilian, and business entities since August 2025. The campaigns use lures to deliver archives or malware, including PhantomRelay, LegionRelay, and Fallspy. The article does not report confirmed operational damage or data loss.
People
Threat Actors
GREYVIBEWithSecure describes GreyVibe as a previously undocumented group targeting Ukrainian entities since August 2025. Researchers are confident it is linked to Russian-speaking operators in the Moscow time zone, but are less certain whether it is a cybercriminal group, a nation-state group, or a mix.UAC-0098WithSecure describes UAC-0098 as an activity cluster likely involving former TrickBot members and previously observed targeting Ukraine; the article says a unique ISO builder may be linked to its ecosystem.
Malware
FallSpyA separate campaign, which the researchers call PrincessClub, used fake adult-club websites to deliver Fallspy (Android malware) and PhantomRelay or LegionRelay on Windows.LegionRelayHowever, while the researchers detected the use of top tier AI including Ideogram AI, ChatGPT, and Google Gemini, GreyVibe introduced design flaws into its LLM-generated LegionRelay Windows malware.PhantomRelayThese would launch a decoy file to take the user’s attention while simultaneously initiating a PhantomRelay (Windows malware) infection chain in the background.
Tools
ChatGPTHowever, while the researchers detected the use of top tier AI including Ideogram AI, ChatGPT, and Google Gemini, GreyVibe introduced design flaws into its LLM-generated LegionRelay Windows malware.Google GeminiHowever, while the researchers detected the use of top tier AI including Ideogram AI, ChatGPT, and Google Gemini, GreyVibe introduced design flaws into its LLM-generated LegionRelay Windows malware.Ideogram AIHowever, while the researchers detected the use of top tier AI including Ideogram AI, ChatGPT, and Google Gemini, GreyVibe introduced design flaws into its LLM-generated LegionRelay Windows malware.
Countries
Industries
BusinessThe primary focus of the group, targeting Ukrainian military, government, civilian, and business entities since August 2025, aligns closely with Russian state interests.GovernmentThe primary focus of the group, targeting Ukrainian military, government, civilian, and business entities since August 2025, aligns closely with Russian state interests.MilitaryThe primary focus of the group, targeting Ukrainian military, government, civilian, and business entities since August 2025, aligns closely with Russian state interests.