Research

Researchers say 'GREYVIBE' crew used AI tools throughout a campaign targeting Ukrainian military and government

Russia-linked cyber espionage crews appear to be using AI tools to help build malware, spin up infrastructure, and craft lures for attacks on Ukrainian targets.

Researchers at WithSecure say a previously undocumented threat group, tracked as "GREYVIBE," has been using OpenAI's ChatGPT, Google's Gemini, and Ideogram AI across almost every stage of its operations targeting Ukraine. The campaign has hit military, government, civilian, and business organizations since at least August 2025.

According to the report, GREYVIBE has used spear-phishing emails, fake CAPTCHA pages, and bogus Ukrainian adult club websites to lure victims into installing malware. The researchers linked the activity to Russian-speaking operators in the Moscow time zone who pursued targets aligned with Russian intelligence interests.

What caught the researchers' attention, however, was the extent to which AI appears to be embedded throughout the operation.

WithSecure said it found "strong evidence" that GREYVIBE systematically relied on AI tools for lure development, malware creation, infrastructure setup, obfuscation tooling, and post-compromise activity. The company said the group's use of AI appeared "operationally integrated rather than isolated or experimental."

"The group's extensive use of GenAI and LLMs is a notable aspect of its tradecraft," wrote Mohammad Kazem Hassan Nejad, senior threat intelligence researcher at WithSecure.

"GREYVIBE appears to use AI not only for isolated development tasks, but across multiple operational phases. This likely enables the group to compensate for capability gaps, accelerate development cycles, and potentially reduce historical backlinks to prior activity."

Despite all the AI tooling, GREYVIBE hardly comes across as a cyber espionage dream team. WithSecure says the operators repeatedly made operational security mistakes, uploaded malware to public services, and left behind development artefacts with names including "letsrollboyos," "totallyunsus," and "cuteuwu."

In one particularly unfortunate own goal, researchers say design flaws in GREYVIBE's LegionRelay malware, which they suspect was developed with LLM assistance, exposed parts of its backend infrastructure and allowed them to monitor activity over an extended period.

The report lands as security vendors continue arguing over whether AI will produce a new generation of elite cyber operators or simply make existing criminals faster and more productive. GREYVIBE looks a lot closer to the second category. ®