GreyVibe is a cyberespionage threat cluster targeting Ukrainian-related entities using AI-generated social engineering lures and custom malware. Their campaigns include spear-phishing with malicious archives, fake CAPTCHA pages, fraudulent adult/dating and military-themed websites, and malware such as LegionRelay and PhantomRelay RATs, and FallSpy Android spyware. The group uses AI tools to create realistic content and malware obfuscators. Indicators suggest a hybrid composition of state-aligned and cybercriminal actors. The malware supports credential theft, data exfiltration, and remote access. The campaign has been active since mid-2025 and focuses on intelligence collection rather than destructive attacks.

The GreyVibe campaigns enable attackers to steal sensitive information including credentials, communication data, device and network details, and media files from targeted Ukrainian organizations. The malware facilitates remote access, data exfiltration, and espionage activities. While no direct destructive impact or widespread exploitation is reported, the intelligence theft poses significant risks to military, government, and civilian sectors in Ukraine. The presence of cryptocurrency miners on some infected machines indicates secondary monetization attempts. The threat actor's use of AI enhances lure effectiveness, increasing the likelihood of successful compromises.

No official patches or fixes apply as this is an active threat actor campaign rather than a software vulnerability. Organizations should leverage available indicators of compromise (IoCs) from WithSecure and other threat intelligence sources to detect and block GreyVibe activity. Defenders should be aware of the sophisticated AI-generated lures and custom malware tools used. Implement targeted email filtering, user awareness training focused on spear-phishing, and endpoint detection for PowerShell-based RATs and Android spyware. Monitor for suspicious network traffic related to known command-and-control infrastructure. No vendor advisory states that no action is required; proactive defense is recommended.