New Russia-Linked GREYVIBE Targets Ukraine with AI-Powered Cyberattacks
Summary: A previously undocumented threat actor called GREYVIBE has run persistent attacks on Ukraine and Ukraine-related entities since at least August 2025, using spear-phishing emails, fake captcha pages, and fraudulent Ukrainian adult club websites to deliver custom obfuscators, loaders, and malware. WithSecure assesses the Russian-speaking group operates in the Russian time zone, aligns with Kremlin intelligence-gathering interests against Ukraine, and uses Ideogram AI, OpenAI ChatGPT, and Google Gemini to generate images and develop its LegionRelay malware, obfuscation and loader scripts, backend infrastructure, and post-compromise commands.
What's compelling: WithSecure rates GREYVIBE low-to-moderately sophisticated and notes its AI-assisted development introduced design flaws that exposed LegionRelay's backend - yet the same AI use lets the group swap out technical artifacts fast enough that traditional clustering methods may become less reliable over time, and its mix of current or former cybercriminals with state-aligned tasking leaves attribution genuinely unresolved.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026