Russian-Linked GREYVIBE Hackers Use AI Tools in Cyberattacks on Ukraine
WithSecure researchers identified GREYVIBE, a Russia-linked threat group, using ChatGPT and Google Gemini to create phishing lures and develop custom malware targeting Ukrainian government, military, and civilian entities since August 2025. The campaign employs multiple infection chains designed to steal information and establish remote access in the ongoing conflict.
What happened
GREYVIBE, a Russian-linked threat cluster, has leveraged ChatGPT and Google Gemini to conduct cyberattacks targeting Ukraine since at least August 2025, according to WithSecure researchers.
The group uses AI tools across lure creation, custom malware code development, and command generation. Multiple infection chains employ phishing emails with malicious archives, fake CAPTCHA pages, and fake websites impersonating Ukrainian entities to deliver malware including PhantomRelay, LegionRelay, and FallSpy.
Reported impact
The campaign targets Ukrainian military, government, civilian, and business sectors, with lures impersonating Ukrainian officials, energy firms, emergency services, and charitable organizations.
Index analysis
The use of public AI tools for malware development and social engineering represents a convergence of artificial intelligence and cyber warfare tactics targeting the Ukraine conflict.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.