Loading malware…
PhantomRelay is a modular PowerShell-based remote access trojan used in intrusion activity associated with the GREYVIBE threat cluster, which has targeted Ukraine and Ukraine-related entities since at least 2025. It is designed for Windows environments and operates through a two-stage execution chain in which an initial fingerprinting component profiles the host before launching the main client. The malware communicates with command infrastructure over WebSockets and supports remote execution of both PowerShell scripts and native Windows commands, enabling flexible post-compromise control.
PhantomRelay has been delivered through multiple social-engineering-driven intrusion chains, including spearphishing campaigns distributing malicious archives, ClickFix-style fake verification pages that trick victims into executing commands, and fraudulent lure websites used in broader espionage operations. Observed campaigns impersonated trusted Ukrainian institutions and services, and victimology included military, government, civilian, and business-related targets, including confirmed Ukrainian combatants in some related operations.
Multiple variants have been tracked, including PhantomRelayLite, PhantomRelayV1, and PhantomRelayV2. PhantomRelayV1 has been reported with a custom watchdog persistence mechanism. The malware has also appeared outside the core Ukraine-focused activity in unrelated cybercrime-linked delivery chains, suggesting either code sharing, reuse, or overlap with broader criminal ecosystems. Overall, PhantomRelay is best characterized as a PowerShell RAT used for host profiling, command execution, and sustained remote access in espionage-oriented campaigns aligned with Russian state intelligence interests, while also showing ecosystem overlap with cybercrime activity.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
PhantomRelay is a PowerShell-based RAT that uses a two-stage execution chain: a fingerprinting script, followed by the main RAT client. The RAT uses WebSockets to communicate with its C2 and supports execution of both PowerShell scripts and Windows commands.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
PhantomRelay variants appeared in a Microsoft Teams voice-phishing campaign and a separate ClickFix delivery chain between February and March 2026...
PhantomMail uses spear-phishing emails with links to malicious archives on Google Drive and 4sync, delivering JavaScript-based loaders and a PowerShell remote access trojan called PhantomRelay.
In early October 2025, the group briefly experimented with ClickFix-style fake CAPTCHA pages for initial malware delivery.
The group has leveraged multiple attack vectors, including spear-phishing e-mails, fake captcha pages and fraudulent Ukrainian adult club websites, to deliver malware to a diverse set of victims.
Initially, the threat actors initiated at least six unique email-based campaigns. These malicious messages deliver dangerous compression archives hosted on popular public storage services. Furthermore, the files contain automated script loaders that deploy localized documents.
Spear-phishing e-mails sent to targeted victims typically contained links to malicious ZIP or RAR archives hosted on third-party file-sharing services such as Google Drive and 4sync.
victims were instructed, in Ukrainian, to run commands under the pretext of completing a Cloudflare-themed security verification process, while the executed command initiated a PhantomRelay infection chain in the background.
PhantomRelay, a PowerShell-based remote access trojan (RAT) designed to profile the host and run PowerShell scripts and Windows commands.
PhantomMail uses spear-phishing emails with links to malicious archives on Google Drive and 4sync, delivering JavaScript-based loaders...
The archives contained PyInstaller- or JavaScript-based loaders that launched a decoy (e.g. a PDF document or an error pop-up) while initiating the PhantomRelay infection chain in the background.
The archives contained PyInstaller- or JavaScript-based loaders that launched a decoy (e.g. a PDF document or an error pop-up) while initiating the PhantomRelay infection chain in the background.
Across these campaigns, the group has relied on custom developed obfuscators, loaders, and malware... WithSecure found evidence of AI assistance across multiple parts of the operation... obfuscation scripts...
Associated domains masqueraded as Zoom conference and LAPAS (Latvian Platform for Development Cooperation) websites.
PhantomRelay is a PowerShell-based RAT that uses a two-stage execution chain: a fingerprinting script, followed by the main RAT client.
PhantomRelay is a PowerShell-based RAT that uses a two-stage execution chain: a fingerprinting script, followed by the main RAT client.
PhantomRelay is a PowerShell-based RAT that uses a two-stage execution chain: a fingerprinting script, followed by the main RAT client.
The RAT uses WebSockets to communicate with its C2 and supports execution of both PowerShell scripts and Windows commands.
This client establishes secure websocket connections to interact with command servers. Alternatively, the actors deploy a lightweight REST client called LegionRelay.
Its capabilities are extended through additional PowerShell scripts delivered by the C2 and dynamically executed on the victim machine.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.