Skip to content
OriginalSign in
Image: SecurityWeek

SecurityWeekKevin Townsend

GreyVibe uses AI in flawed attacks via spear phishing on Ukraine

Part of the GreyVibe story · since 28 May

Quiet for 21 weekslast report 3 Jun4 articles4 outlets
28 May · SecurityWeek first16 Aug12 Sep9 OctNowThis article1st of 4
  • Thu 28 May, 19:00 UTC. SecurityWeek, first report. GreyVibe uses AI in flawed attacks via spear phishing on Ukraine. This article, 1st of 4.
  • Fri 29 May, 12:31 UTC. The Hacker News, its first report on the story. Russia linked GREYVIBE uses AI attacks against Ukraine.
  • Fri 29 May, 19:30 UTC. Security Affairs, its first report on the story. GREYVIBE Deploys AI Malware on Ukraine, Reveals Operational Slip.
  • Wed 3 Jun, 13:16 UTC. SecurityOnline, its first report on the story. GreyVibe Hackers Use AI Enhanced Phishing to Spy on Ukraine.

The article discusses the threat actor group GreyVibe, believed to be linked to Russian-speaking individuals, which has been targeting Ukrainian entities since August 2025. Despite showing operational ambition and utilizing advanced AI technologies in their attacks, GreyVibe has demonstrated design flaws that suggest they may not consist of elite hackers. Their tactics include spear-phishing campaigns and the use of fake websites to deploy various malware types.

Researchers from WithSecure highlight the group's extensive AI usage as a means to enhance their capabilities and complicate tracking efforts. There is ongoing speculation about whether GreyVibe may broaden its operations beyond Ukraine in the future.

How the story developed

All 4 articles
Quiet for 21 weekslast report 3 Jun4 articles4 outlets

4 articles from 4 outlets since 28 May. Quiet since 3 Jun. This was the first report.

Now28 May3031234529 OctFirst reportSecurityWeek · 28 May, 19:00Picked up againafter 5 days quiet
  • Thu 28 May, 19:00 UTC. SecurityWeek, first report. GreyVibe uses AI in flawed attacks via spear phishing on Ukraine. This article, 1st of 4.
  • Fri 29 May, 12:31 UTC. The Hacker News, its first report on the story. Russia linked GREYVIBE uses AI attacks against Ukraine.
  • Fri 29 May, 19:30 UTC. Security Affairs, its first report on the story. GREYVIBE Deploys AI Malware on Ukraine, Reveals Operational Slip.
  • Wed 3 Jun, 13:16 UTC. SecurityOnline, its first report on the story. GreyVibe Hackers Use AI Enhanced Phishing to Spy on Ukraine.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 4 articles as a list
  1. Thu 28 MayDay 01
    1. GreyVibe uses AI in flawed attacks via spear phishing on Ukraine19:00 · SecurityWeek · First report · This article, 1st of 4
  2. Fri 29 MayDay 12
    1. Russia linked GREYVIBE uses AI attacks against Ukraine12:31 · The Hacker News
    2. GREYVIBE Deploys AI Malware on Ukraine, Reveals Operational Slip19:30 · Security Affairs

  3. Quiet for 5 days

    Wed 3 JunDay 61
    1. GreyVibe Hackers Use AI Enhanced Phishing to Spy on Ukraine13:16 · SecurityOnline · Picked up again

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in