Loading story…
WithSecure reported that a previously undocumented Russia-linked threat group, GREYVIBE, has conducted cyber espionage operations against Ukrainian military, government, civilian, and business organizations since at least August 2025. The actor reportedly used ChatGPT, Google Gemini, and Ideogram AI across multiple stages of its operations, including phishing-lure creation, malware and loader development, obfuscation, infrastructure setup, and post-compromise activity. Delivery methods included spear-phishing emails, fake CAPTCHA pages, fraudulent Ukrainian adult-club websites, and charity-themed lure sites.
Researchers said GREYVIBE deployed malware families including PhantomRelay, LegionRelay, and FallSpy, and assessed the operators as Russian-speaking and aligned with Kremlin intelligence interests tied to the war in Ukraine. Despite broad AI adoption, the group was described as low-to-moderately sophisticated and prone to operational security failures, including public malware uploads, exposed development artifacts, and flaws in LegionRelay that revealed parts of its backend infrastructure. Investigators also noted signs of overlap with the Russian cybercrime ecosystem, including cybercrime-linked tooling and occasional XMRig deployment, underscoring a blurred line between state-aligned espionage and criminal tradecraft.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
Researchers said GREYVIBE made repeated operational security mistakes, such as uploading malware to public services and leaving development artifacts behind. WithSecure also reported that flaws in the group's LegionRelay malware exposed parts of its backend infrastructure and enabled extended monitoring of its activity.
WithSecure assessed GREYVIBE as a previously undocumented, Russian-linked threat actor whose operators are Russian-speaking, work broadly in the Russian/Moscow time zone, and align with Kremlin intelligence interests. The report also said the group used generative AI tools including ChatGPT, Gemini, and Ideogram AI across lure creation, malware and obfuscator development, infrastructure setup, and post-compromise activity.
In March and April 2026, WithSecure observed a campaign tracked as DroneLink that overlapped operationally with PrincessClub. DroneLink used fake charity websites themed around support for the Armed Forces of Ukraine and shared command-and-control infrastructure and tooling with GREYVIBE-associated activity.
WithSecure reported that the previously undocumented threat group GREYVIBE has targeted Ukrainian military, government, civilian, business, and other Ukraine-related organizations since at least August 2025. The campaign used spear-phishing emails, fake CAPTCHA pages, fraudulent Ukrainian adult-club websites, and charity-themed lure sites to deliver malware including PhantomRelay, LegionRelay, and FallSpy.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
8 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcescworld.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourcetheregister.com
Open sourcewithsecure.com
Open sourcelabs.withsecure.com
Open sourcecloud.google.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A previously unreported cyber espionage campaign has been uncovered targeting Russian military personnel and defense industry organizations. The campaign, attributed to the group known as Goffee, utilized phishing lures such as fake New Year concert invitations and forged official letters to entice victims into opening malicious XLL files. Once executed, these files deployed a new backdoor named EchoGather, which enabled attackers to collect system information, execute commands, and exfiltrate files to a command-and-control server disguised as a food delivery website. The phishing documents showed signs of artificial generation, including linguistic errors and poorly imitated Russian emblems, suggesting the use of AI-generated decoys to enhance stealth and evade detection. Researchers from Intezer first identified the malicious XLL file on VirusTotal, with uploads originating from both Ukraine and Russia. The campaign demonstrates the evolving tactics of the Goffee group, which has been active since at least 2022, as they experiment with new methods to bypass security controls. The use of AI-generated content and XLL-based payloads highlights a growing trend in cyber espionage operations, particularly those targeting sensitive sectors such as defense. The full extent of the campaign's success and the specific data sought by the attackers remain unclear, but the operation underscores the persistent threat posed by sophisticated, state-aligned cyber actors.
Jun 29, 2026
A joint government advisory says Russia’s GRU Unit 26165, also tracked as **APT28** or **Fancy Bear**, has run a sustained cyberespionage campaign against Western logistics providers, technology companies, and defense supply-chain organizations supporting aid flows to Ukraine. The activity has affected entities in the United States, Germany, Poland, France, and Ukraine, with intrusions aimed at transportation networks, IT services, and military-related logistics. Officials said the operators also sought visibility into aid movements by compromising internet-connected IP cameras positioned near border crossings, rail hubs, and military facilities. Authorities linked the campaign to long-running GRU tradecraft previously used against governments, militaries, defense contractors, and cloud and email environments including Microsoft Office 365 and on-premises Exchange. Reported access methods include password spraying, brute-force and credential-guessing attacks, spearphishing, exploitation of known vulnerabilities including `CVE-2020-0688` and `CVE-2020-17144`, and the use of malware such as **HEADLACE** and **MASEPIE**, alongside web shells, Tor, VPNs, and living-off-the-land techniques to persist and exfiltrate data. Agencies warned the espionage effort remains active and urged organizations to enforce MFA, patch exposed systems, tighten access controls, monitor for lateral movement, and review supply-chain risk.
Jun 29, 2026
State-sponsored threat groups used Russia-Ukraine war-themed phishing documents to conduct cyber-espionage campaigns across Latin America, the Middle East, and South Asia. Check Point Research reported that **El Machete** targeted financial and government organizations in Nicaragua and Venezuela with malicious Word files that delivered Python-based malware, including a customized **Loki.Rat** variant and a second-stage **JavaOracle** payload, while **Lyceum** targeted the energy sector in Israel and likely Saudi Arabia using war-related decoys and droppers to install **.NET DNS**, **.NET TCP**, and **Golang HTTP** backdoors. In South Asia, **SideWinder** targeted Pakistani entities with a Russia-Ukraine-themed lure that used remote template injection and exploited **`CVE-2017-11882`** to deploy its long-running **.NET infostealer**. The activity showed how espionage-focused actors quickly adapted a major geopolitical crisis into convincing spear-phishing content to improve targeting and compromise government, financial, and energy-sector victims.
Aug 15, 2026