GreyVibe hackers use ChatGPT, Gemini to power cyberattacks
WithSecure says GreyVibe used ChatGPT, Gemini and other AI tools to build convincing lures and custom malware for espionage campaigns tied to Ukraine.
Intelligence analysis by GPT-5.4 Mini
WithSecure says the GreyVibe group has run a long campaign since at least August 2025, targeting military, government, civilian, and business entities with AI-assisted phishing, fake sites, and custom malware. The researchers think the operation fits Russian interests, but they stop short of calling it a fully mature nation-state unit.
A hacking group made fake messages and fake websites to trick people into opening doors for them. The scary part is that they seem to have used AI tools to make those traps look more real.
It is like someone using a drawing robot to make very convincing fake signs, fake forms, and fake uniforms. That makes the trick harder to spot.
The security researchers say the group was trying to spy on targets in Ukraine-related places, and that the tools they used could steal files, passwords, phone data, and other private information.
Analysis
What WithSecure found
WithSecure says it uncovered a GreyVibe campaign in January that had already been active since at least August 2025. The targets were mainly Ukrainian or Ukraine-related organizations, and the activity reached military, government, civilian, and business sectors. The researchers say several signals point to a Russian-speaking operator, including malware-panel language, code comments, and C2 timing set to UTC+3.
How the campaign worked
GreyVibe used multiple lure families. Some attacks relied on spear-phishing emails with ZIP or RAR archives hosted on Google Drive or 4sync, while others used fake CAPTCHA or ClickFix pages that tried to trick victims into running malicious commands. The group also ran fake adult and dating sites, fake charity sites themed around FPV drones and UAVs, and a fake Russian military login page. WithSecure says the lures were unusually polished and were likely helped by ChatGPT, Google Gemini, and Ideogram AI.
Malware and tradecraft
The malware set included custom obfuscators such as LOOKVALPS, LOOKVALJS, DAYLIGHT, and TEASOUP. The researchers also link AI assistance to a PowerShell RAT called LegionRelay, which can steal files, take screenshots, grab browser credentials, access Telegram and WhatsApp data, and set up RDP access. Another RAT, PhantomRelay, supports fingerprinting and command execution. GreyVibe also used FallSpy Android spyware to collect contacts, call logs, location, media, and SIM data.
WithSecure says the group looks consistent with a state-aligned operation, but not one with the discipline usually seen in mature nation-state units. They also note signs that current or former cybercriminals may be involved, including use of a builder tied to former TrickBot members, public uploads of test samples, and cryptocurrency miner deployment on some victims.
Key points
- WithSecure links GreyVibe to a long-running espionage campaign active since at least August 2025.
- The group targeted Ukrainian and Ukraine-related organizations across military, government, civilian, and business sectors.
- Researchers say AI tools helped produce convincing lures and may also have helped build custom malware.
- GreyVibe used phishing emails, fake CAPTCHA pages, fake sites, and Android spyware in different attack chains.
- WithSecure thinks the operation looks state-aligned but not as disciplined as a mature nation-state group.
