Adversary Intelligence — 2026-05-30

Russia-Linked GreyVibe Group Uses AI Tools to Target Ukrainian Military and Government

BLUFGREYVIBE's operationally embedded AI use across the kill chain provides a replicable model for lower-tier actors, while converging criminal indicators make formal Russian state attribution unlikely through late 2026.

WithSecure on May 28 disclosed GREYVIBE, a previously untracked Russia-nexus group that has targeted Ukrainian military, government, and business entities since at least August 2025 via spear-phishing, fake CAPTCHA pages, fraudulent Ukrainian websites, and a parallel PrincessClub campaign delivering Fallspy Android malware through fake adult-club lure sites 123. The group systematically used Ideogram AI, ChatGPT, and Google Gemini across lure creation, malware development, and post-compromise scripting, with WithSecure assessing the integration as deliberate and operationally embedded rather than experimental 13. Design flaws in LegionRelay, a PowerShell RAT WithSecure assesses as LLM-developed, exposed backend infrastructure and gave researchers sustained operational visibility into the group's activity over several months 13. Operators are Russian-speaking and active in the Moscow time zone, but WithSecure identified cybercrime ecosystem indicators, including suspected shared tooling with TrickBot-linked UAC-0098 and XMRig miner deployments on victim machines, and assessed the group's relationship to the Russian state as indeterminate 123.

Analysis
GREYVIBE's systematic AI integration across lure creation, malware development, and post-compromise scripting sets a replicable template for lower-sophistication actors in conflict-adjacent environments. Given the single-vendor baseline, a second vendor or Western government publicly attributing GREYVIBE to GRU, FSB, or SVR within six months is unlikely. Moderate confidence rests on WithSecure's own indeterminate state-relationship finding and the convergence of TrickBot-linked tooling and XMRig deployments on victim machines, each of which undercuts the clean intelligence picture formal attribution requires. Deliberate footprint contamination with criminal tooling explains those markers as well as genuine hybrid structure. The LegionRelay design flaw that gave researchers sustained operational visibility closes now that the disclosure is public, and whether attribution ultimately resolves determines whether a government can invoke formal sanctions or must treat GREYVIBE as an indefinitely unattributed hybrid actor when sizing Ukraine-sector defensive posture.
5 sources
  1. GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations - WithSecure Labs
  2. GreyVibe hackers use ChatGPT, Gemini to power cyberattacks - BleepingComputer
  3. New Russian-Linked GREYVIBE Targets Ukraine with AI-Powered Cyberattacks - The Hacker News
  4. Russia-Linked GreyVibe Attackers Use AI to Supercharge Cyberattacks - SecurityWeek
  5. Russia-linked threat group put ChatGPT to work from lure to payload - The Register

View in full brief →

UNCLASSIFIED // OPEN SOURCE