WithSecure Labs has exposed GREYVIBE, a previously undocumented Russian-speaking threat actor conducting sustained attacks on Ukraine and Ukraine-related entities since at least August 2025. The group's defining characteristic is systematic use of generative AI across the full attack lifecycle — from lure creation and code obfuscation to post-compromise command generation.
GREYVIBE operates five parallel attack chains, targeting Ukrainian military, government, civilian, and business organizations. Connections to the TrickBot gang and UAC-0098 — a group with established ties to Russian cybercriminal networks — place this actor within a broader ecosystem of Kremlin-adjacent operations.
Despite extensive AI augmentation, WithSecure assesses the group as low-to-moderately sophisticated, noting repeated operational security failures. This matters strategically: the AI tools are compensating for skill gaps, not amplifying elite tradecraft. Any organization connected to Ukrainian interests should treat this actor as an active, persistent threat.
◈ Table of Contents
Phase 1: Actor Profile
THREAT ACTOR| Attribute | Detail |
|---|---|
| Designation | GREYVIBE |
| Attribution | Russian-speaking, Russian time zone, Kremlin-aligned interests |
| First seen | August 2025 (earliest confirmed activity) |
| Assessed sophistication | Low-to-moderate — AI-augmented to compensate for skill gaps |
| Criminal connections | TrickBot gang, UAC-0098 |
| Primary objective | Intelligence gathering aligned with Russo-Ukrainian war |
| Research source | WithSecure Labs, published May 29, 2026 |
GREYVIBE's criminal-ecosystem connections (TrickBot, UAC-0098) suggest access to established infrastructure. Initial access vectors may include credentials purchased from criminal markets rather than traditional phishing campaigns.
Phase 2: Targeting & Victims
VICTIMOLOGYMilitary
Ukrainian armed forces and defense-adjacent organizations targeted with military-themed spear-phishing lures.
Government
Ukrainian government entities targeted, consistent with intelligence collection objectives supporting Kremlin strategic interests.
Ukraine-Related Entities
Foreign organizations with material connections to Ukraine — NGOs, diaspora groups, and international support organizations — are also in scope.
Business & Civilian
Private-sector companies operating in or near Ukraine. Civilian targeting reflects broad intelligence-collection rather than purely military focus.
Phase 3: TTPs & Attack Chains
TECHNIQUES- 1AI-generated lure email — ChatGPT or Gemini used to draft contextually plausible content targeting individual recipients.
- 2Phishing link delivery — Points to actor-controlled infrastructure hosting a ZIP or RAR archive.
- 3Archive extraction — Contains a loader or dropper that stages the next payload.
- 4PhantomRelay RAT deployment — PowerShell-based remote access trojan establishes C2 channel.
Fake CAPTCHA delivery is now observed across multiple Russian-nexus actor campaigns. Any CAPTCHA page that instructs the user to open a terminal, run Windows+R, or paste a command should be treated as an active attack.
Phase 4: AI Augmentation Details
NOVEL TTP| AI Platform | Use in Attack Lifecycle |
|---|---|
| ChatGPT | Code development, obfuscation script generation, post-compromise command drafting |
| Google Gemini | Code development, backend infrastructure scripting |
| Ideogram AI | Image generation for phishing lures and social engineering assets |
AI-generated code and lures do NOT guarantee sophistication. WithSecure documented multiple operational security blunders — exposed infrastructure, reused patterns. The AI tools are lowering the barrier to entry, not elevating the ceiling.
- Commercial AI access allows groups with limited coding skill to generate functional malware and obfuscation
- AI-generated phishing lures are harder to detect via simple keyword filtering
- AI-generated images (Ideogram) enable rapid production of fake logos and visual lures
- The opsec failures remain detectable — the operator, not the AI, is the weak link
Phase 5: Indicators of Compromise
IOCS| Type | Indicator | Notes |
|---|---|---|
| Process | powershell.exe with -EncodedCommand | Spawned from archive extractors |
| Process | wscript.exe or mshta.exe | Possible second-stage loaders |
| Network | HTTPS C2 to hosting-provider ranges | PhantomRelay callback pattern |
| File | ZIP/RAR archives from phishing links | Archive-then-execute delivery |
| Lure content | AI-generated Ukrainian-language text | Grammar-perfect, contextually targeted |
Phase 6: Detection Logic
HUNT QUERIESFalse positive baseline: legitimate enterprise software may trigger on archive-based installers that invoke PowerShell. Scope by excluding known-good parent hashes and monitor net-new parent process image paths.
Phase 7: MITRE ATT&CK Mapping
TECHNIQUE MAP| Tactic | Technique ID | Technique | Evidence |
|---|---|---|---|
| Resource Development | T1588.002 | Obtain Capabilities: Tool | Commercial AI platforms used for tooling |
| Initial Access | T1566.002 | Spear-Phishing Link | PhantomMail chain |
| Initial Access | T1566.001 | Spear-Phishing Attachment | ZIP/RAR delivery |
| Execution | T1059.001 | PowerShell | PhantomRelay RAT |
| Execution | T1204.002 | User Execution: Malicious File | Archive-based delivery |
| C2 | T1071.001 | Application Layer Protocol: Web | HTTPS C2 callback |
| Defense Evasion | T1027 | Obfuscated Files or Information | AI-generated obfuscation scripts |
Sources & References
ATTRIBUTION🚨 SCAN FOR GREYVIBE IOCs
If your organization has connections to Ukraine or Ukrainian interests, check your environment against known behavioral indicators. Use CyberHawk's IOC Scanner to cross-reference PhantomRelay infrastructure hashes and network signatures.
→ Launch IOC Scanner at cyberhawkthreatintel.com/ioc-scanner
◈ Stay Connected
Follow CyberHawk Threat Intel for threat intelligence, deployment guides and hands-on SOC tooling content.
"They can't exploit you if you are the Exploit."