GreyVibe hackers use ChatGPT, Gemini to power cyberattacks
GreyVibe Russian threat group uses ChatGPT and Gemini to generate phishing lures and malware targeting Ukrainian
WithSecure discovered GreyVibe, a likely Russian threat cluster active since August 2025, conducting cyberespionage campaigns against Ukrainian military, government, and civilian organizations. The group leverages AI tools (ChatGPT, Gemini, Ideogram) to create realistic phishing lures and uses custom malware including LegionRelay, PhantomRelay, and FallSpy to steal data and establish remote access. Evidence suggests the operators may include former cybercriminals rather than pure nation-state actors, based on operational patterns and tool reuse.
AI summary of the linked source. Not reviewed by an editor. How this works
Run WithSecure?
Get an email when a new story names WithSecure, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe GreyVibe threat group demonstrates how cybercriminals are weaponizing AI tools like ChatGPT and Gemini to create sophisticated, realistic phishing content that can bypass traditional detection methods. This evolution in attack methodology makes social engineering attacks significantly more convincing and harder to identify through typical awareness training. The campaign's success against military and government targets highlights the critical need for enhanced detection capabilities and updated security awareness programs that account for AI-generated threats.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — LegionRelay
- malware — PhantomRelay
- malware — FallSpy
- malware — LOOKVALPS
- malware — LOOKVALJS
- malware — DAYLIGHT
- malware — TEASOUP