[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fT0ieKCo9Pa-fJKPPwt764GQAHcqJ5R4FGYdpkE-9C-k":3},{"article":4,"iocs":53,"watch_terms":72,"solutions":73,"lesson":159},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"ea84604c-fe56-4616-9c8a-91db95341064","GreyVibe hackers use ChatGPT, Gemini to power cyberattacks","greyvibe-hackers-use-chatgpt-gemini-to-power-cyberattacks-c40f0d","A likely Russian threat cluster tracked as GreyVibe has been targeting Ukrainian entities with AI-generated lures and a rich set of custom malware tools. [...]","WithSecure discovered GreyVibe, a likely Russian threat cluster active since August 2025, conducting cyberespionage campaigns against Ukrainian military, government, and civilian organizations. The group leverages AI tools (ChatGPT, Gemini, Ideogram) to create realistic phishing lures and uses custom malware including LegionRelay, PhantomRelay, and FallSpy to steal data and establish remote access. Evidence suggests the operators may include former cybercriminals rather than pure nation-state actors, based on operational patterns and tool reuse.","GreyVibe Russian threat group uses ChatGPT and Gemini to generate phishing lures and malware targeting Ukrainian","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fgreyvibe-hackers-use-chatgpt-gemini-to-power-cyberattacks\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2024\u002F06\u002F06\u002FRussian-spies.jpg","2026-05-28T22:24:49+00:00","2026-05-29T00:00:14.57983+00:00",9,[17,20,22,25,28,30],{"name":18,"type":19},"GreyVibe","threat_actor",{"name":21,"type":19},"UAC-0098",{"name":23,"type":24},"WithSecure","vendor",{"name":26,"type":27},"ChatGPT","technology",{"name":29,"type":27},"Google Gemini",{"name":31,"type":27},"Ideogram AI","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":34,"name":35,"slug":36},null,"Nation-state","nation-state",[38,43,48],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,57,60,63,66,68,70],{"type":47,"value":55,"context":56},"LegionRelay","PowerShell-based RAT supporting file theft, credential theft, and RDP access setup",{"type":47,"value":58,"context":59},"PhantomRelay","PowerShell RAT with system fingerprinting and dynamic script loading capabilities",{"type":47,"value":61,"context":62},"FallSpy","Android spyware collecting contacts, location, call logs, and media files",{"type":47,"value":64,"context":65},"LOOKVALPS","Custom obfuscator likely developed with LLM assistance",{"type":47,"value":67,"context":65},"LOOKVALJS",{"type":47,"value":69,"context":65},"DAYLIGHT",{"type":47,"value":71,"context":65},"TEASOUP",[23],{"controls":74,"vendors":155},[75,103,132],{"slug":76,"name":77,"problem":78,"products":79},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[80,87,95],{"vendor_slug":81,"vendor_name":23,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"withsecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":104,"name":105,"problem":106,"products":107},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[108,116,124],{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"slug":133,"name":134,"problem":135,"products":136},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[137,144,149],{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":138,"product_name":141,"url":142,"description":143},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":145,"product_name":146,"url":147,"description":148},"managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":150,"vendor_name":151,"vendor_logo":152,"product_slug":150,"product_name":151,"url":153,"description":154},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[156],{"slug":81,"name":23,"logo_path":82,"roles":157},[158],"reported_by",{"slug":160,"title":161,"body":162,"framework_refs":163,"framework_notes":170},"ai-enhanced-phishing-campaign-targets-ukrainian-organizations","AI-Enhanced Phishing Campaign Targets Ukrainian Organizations","The GreyVibe threat group demonstrates how cybercriminals are weaponizing AI tools like ChatGPT and Gemini to create sophisticated, realistic phishing content that can bypass traditional detection methods. This evolution in attack methodology makes social engineering attacks significantly more convincing and harder to identify through typical awareness training. The campaign's success against military and government targets highlights the critical need for enhanced detection capabilities and updated security awareness programs that account for AI-generated threats.",[164,165,166,167,168,169],"NIST SP 800-50","CIS Control 14","NIST CSF PR.AT","CIS Control 8","NIST SP 800-61","ISO 27035",{}]