New Russian-Linked GREYVIBE Targets Ukraine with AI-Powered Cyberattacks

GREYVIBE is a Russian-linked threat actor targeting Ukraine since August 2025, using AI-powered tools and multiple attack vectors.

• •The group deploys malware variants including PhantomMail, PhantomRelay, PhantomClick, PrincessClub, DroneLink, and Nebo through spear-phishing, fake CAPTCHA pages, and fraudulent websites.
• •Attack chains deliver malware via ZIP/RAR archives on Google Drive, fake Zoom/LAPAS pages, fake Ukrainian adult-club sites, and charity foundation impersonation.
• •GREYVIBE uses generative AI (Ideogram AI, ChatGPT, Google Gemini) to develop malware, obfuscators, loaders, and post-compromise commands.
• •The group maintains ties to Russian cybercrime ecosystem through shared tools and members with cybercriminal backgrounds.

This summary was automatically generated by AI based on the original article and may not be fully accurate.