GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations

GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations - WithSecure™ By Authors

Executive Summary

WithSecure identified an ongoing and persistent set of activity targeting Ukraine and Ukraine-related entities since at least August 2025.

Based on significant overlaps observed across both development and operational phases of the associated campaigns, WithSecure associates the activities with a threat group tracked as GREYVIBE. At the time of writing, WithSecure has not identified definitive links between GREYVIBE and any previously tracked threat group.

The group has leveraged multiple attack vectors, including spear-phishing e-mails, fake captcha pages and fraudulent Ukrainian adult club websites, to deliver malware to a di…