# Russia-Linked GREYVIBE Deploys AI-Powered Malware Against Ukraine in Sustained Espionage Campaign


A previously undocumented Russian-speaking threat actor dubbed GREYVIBE has been conducting persistent cyberattacks against Ukrainian military, government, and civilian organizations since at least August 2025, according to new analysis from Finnish cybersecurity firm WithSecure. What distinguishes this campaign is not just its scope or the diverse tactics employed, but rather the adversary's aggressive adoption of generative AI and large language models to accelerate malware development and operational tempo—a troubling indicator of how state-affiliated threat actors are operationalizing emerging technologies to enhance their attack capabilities.


## The Threat


GREYVIBE operates as a Russian-speaking group assessed to be operating broadly within Russian time zones, with activity patterns and targeting that align squarely with Kremlin state interests. The adversary maintains a remarkably diverse arsenal of delivery mechanisms and custom-developed malware families, targeting a wide swath of victim organizations across multiple sectors.


Confirmed victims include:

  • Military and defense organizations
  • Government agencies and officials
  • Civilian businesses and enterprises
  • Journalists and civil society groups
  • Ukraine-related entities and supporters worldwide

    • What makes GREYVIBE particularly noteworthy is not operational sophistication in the traditional sense—WithSecure characterizes the group as "low-to-moderately sophisticated" and notes significant operational security blunders—but rather its pragmatic approach to compensating for technical skill gaps through automation and AI-assisted tooling. Members are believed to include both current and former Russian cybercriminals, suggesting a hybrid structure that bridges the gap between state-sponsored espionage and the Russian underground cybercrime ecosystem.


    ## Background and Context


    The timing of GREYVIBE's emergence in August 2025 places the threat actor's initial activity roughly 18 months into the Russo-Ukrainian war. By this point, both Ukrainian defensive capabilities and Western security assistance had matured considerably, creating an environment where persistent espionage operations become increasingly valuable to Russian strategic interests.


    Intelligence gathering remains central to wartime operations. Russia has historically invested heavily in signals intelligence and human intelligence (HUMINT) against Ukraine, and cyber espionage complements these efforts by providing direct access to target networks, intercepted communications, and strategic decision-making information. GREYVIBE appears designed to fill exactly this role—a persistent, adaptable espionage platform rather than destructive malware designed to disrupt infrastructure.


    The group's operational continuity over more than nine months suggests either:

    1. Adequate resources and organizational structure to maintain operations despite discovery

    2. Sufficient success rate to justify continued investment

    3. A mandate that extends beyond Ukraine itself to other intelligence collection priorities


    ## Technical Details: The Attack Arsenal


    WithSecure identified six distinct attack chains, each employing different delivery mechanisms and malware payloads:


    ### PhantomMail

    The most direct attack vector relies on spear-phishing emails containing links to malicious archives (ZIP or RAR files) hosted on legitimate cloud platforms including Google Drive and 4sync. These archives contain JavaScript-based loaders that deploy a decoy document to the victim while silently installing secondary payloads. The use of legitimate cloud hosting suggests an attempt to bypass traditional email gateway controls and reputation-based filtering.


    ### PhantomClick

    This chain mimics the "ClickFix" social engineering technique, presenting victims with fake CAPTCHA verification pages hosted on domains impersonating services like Zoom and LAPAS (a legitimate Ukrainian government portal). Users tricked into "solving" these fake CAPTCHAs unknowingly execute commands that trigger the PhantomRelay remote access trojan infection chain.


    ### PrincessClub

    Perhaps the most elaborate lure, this campaign operates fake Ukrainian adult entertainment club websites designed to appeal to potential military and government targets. The sites have evolved to include WebRTC-based video calling features, creating bidirectional interaction that allows attackers to capture audio and video from victim devices. The campaign delivers FallSpy (Android spyware) or PhantomRelay/LegionRelay variants depending on the victim's platform.


    ### DroneLink

    This attack vector uses fake charity websites purporting to support the Ukrainian Armed Forces, delivering WireGuard VPN clients and LegionRelay payloads. The use of charitable fronts likely exploits pro-Ukraine sympathies among potential victims.


    ### Nebo

    The most culturally sophisticated campaign, this attack uses FallSpy samples disguised as Russian-language military login screens—a tactic likely designed to deceive Ukrainian military personnel into believing they were accessing Russian systems, possibly after capture or defection.


    ### Core Malware Families


    PhantomRelay is a PowerShell-based remote access trojan capable of executing arbitrary PowerShell scripts and Windows commands for reconnaissance and lateral movement. PhantomRelayV1 variants include a custom watchdog persistence mechanism to survive system reboots.


    LegionRelay is a lightweight PowerShell-based RAT supporting:

  • File enumeration and exfiltration
  • Screenshot capture
  • Browser data theft (including saved credentials)
  • Telegram and WhatsApp data extraction
  • RDP access initialization for subsequent lateral movement

    • FallSpy is an Android spyware family focused on harvesting sensitive data from compromised mobile devices, likely targeting information stored locally or accessible through the Android API.


    ## AI-Assisted Malware Development


    Perhaps the most significant aspect of this campaign is GREYVIBE's documented reliance on generative AI platforms to accelerate development and reduce attribution risk. WithSecure identified usage of:


  • OpenAI's ChatGPT — for developing LegionRelay code, obfuscation scripts, and loader infrastructure
  • Google Gemini — for malware development assistance
  • Ideogram AI — for generating social engineering imagery used in phishing campaigns

    • The adversary leveraged AI for:

  • Image generation for social engineering lures
  • Malware code development and refactoring
  • Obfuscation and loader script generation
  • Backend infrastructure development
  • Post-compromise command development

    • This represents a qualitative shift in how state-affiliated threat actors can scale operations. Rather than requiring a team of specialized developers, an organized group with basic malware knowledge can now use AI to:

    1. Bridge technical skill gaps — AI platforms can generate functional code from high-level descriptions

    2. Accelerate development cycles — weeks of development condense to hours

    3. Obscure attribution — frequent regeneration of malware variants reduces reliance on known samples that could facilitate attribution

    4. Reduce operational overhead — fewer specialized technical personnel required


    ## Implications for Organizations


    The GREYVIBE campaign carries several implications that extend well beyond Ukraine:


    Attribution becomes harder. Traditional malware analysis relies on identifying code patterns, compilation artifacts, and reused libraries that link samples together. When adversaries regenerate variants using AI models, each sample becomes effectively unique while maintaining core functionality. This complicates both attribution and the development of reliable detection signatures.


    Speed of operations increases. Spear-phishing campaigns can now cycle through new lures, payloads, and infrastructure faster than defenders can analyze and respond to previous iterations.


    Operational security degrades. WithSecure notes GREYVIBE exhibits "operational security blunders," suggesting the group is still learning to operationalize these tools effectively. As maturation occurs, we can expect tighter OPSEC alongside AI-accelerated development.


    Cross-border targeting expands. While current targeting focuses on Ukraine, the modular nature of the attack chains and use of cloud-based infrastructure suggests potential for rapid pivot to other targets or geographic regions.


    ## Recommendations


    For Ukrainian organizations:

  • Implement multi-factor authentication across all critical systems
  • Deploy advanced email security controls capable of analyzing dynamic URL content and sandboxing suspicious archives
  • Conduct regular security awareness training focused on social engineering and phishing indicators
  • Monitor for suspicious PowerShell execution and remote desktop protocol access attempts
  • Review cloud storage sharing permissions and disable broad sharing where possible

    • For Western organizations supporting Ukraine:

  • Assume supply chain risk from Ukrainian vendors and partners; implement heightened monitoring for suspicious network activity from these connections
  • Review third-party access and implement zero-trust architectural principles
  • Maintain detailed logs of administrative activity and remote access sessions
  • Establish rapid incident response procedures for mobile device compromise

    • For security vendors and incident responders:

  • Develop behavioral detection strategies that focus on malware functionality rather than code signatures
  • Monitor for AI-generated malware characteristics and patterns in obfuscation
  • Maintain threat intelligence sharing relationships to identify emerging attack infrastructure quickly
  • Invest in dynamic analysis and detonation capabilities to maintain detection efficacy against rapidly regenerated variants

    • ## HackWire Analysis


    The GREYVIBE campaign illustrates a critical inflection point in the sophistication-complexity tradeoff that has long defined threat actor operations. Historically, advanced persistent threat (APT) groups have relied on highly specialized technical talent to develop custom malware and maintain operational security. This created a natural scaling bottleneck—you can only hire so many talented malware developers, and they require years of experience to operate effectively.


    Generative AI disrupts this entirely. An organized group with basic technical capability and funding can now leverage AI platforms to automate the parts of malware development that previously required specialized expertise. This doesn't make GREYVIBE a highly sophisticated actor in traditional terms—WithSecure correctly identifies them as "low-to-moderately sophisticated"—but it enables them to *operate* with sophistication at scale. They can afford to burn through variants, change tactics weekly, and maintain multiple attack chains simultaneously because the marginal cost of generating new code and infrastructure approaches zero.


    This has profound implications beyond cybersecurity. The convergence of state-sponsored espionage with democratized AI-powered development tools suggests we're entering an era where the ability to conduct sophisticated cyberattacks becomes decoupled from the existence of rare specialized talent. A moderately resourced state actor or organized cybercriminal group can now compete operationally with much better-resourced defenders.


    The second critical pattern here is targeting methodology. GREYVIBE's lures are remarkably sophisticated in their cultural and contextual understanding—fake military login screens targeting captured or turned soldiers, adult entertainment sites targeting military personnel, charity fronts exploiting pro-Ukraine sentiment. This suggests either deep targeting intelligence or an expectation that volume will overcome targeting inefficiency. Either way, it indicates this is not opportunistic crime but coordinated intelligence collection with clear objectives.


    For defenders, the implications are stark. Signature-based detection is becoming increasingly obsolete against AI-assisted attackers. The focus must shift toward behavioral detection, anomaly identification, rapid incident response, and most critically, resilience architecture that assumes compromise. If threat actors can generate new malware faster than you can develop signatures, the only viable defense is making your environment hostile to post-compromise activity—limiting lateral movement, restricting data exfiltration, and detecting unusual behavior patterns.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Cyber Espionage](https://www.hackwire.news/category/cyber-espionage) coverage
  • Cross-reference with [Malware](https://www.hackwire.news/category/malware) and [Artificial Intelligence](https://www.hackwire.news/category/artificial-intelligence)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)