GreyVibe Threat Group Leverages AI (ChatGPT, Gemini) for Sophisticated Phishing and Malware Campaigns Targeting Ukrainian Entities
What Happened – A Russian‑linked threat group identified as GreyVibe has been running a multi‑year cyber‑espionage operation that uses large language models (ChatGPT, Google Gemini, Ideogram AI) to auto‑generate convincing phishing lures and to assist in building custom PowerShell‑based RATs (LegionRelay, PhantomRelay). The campaign, active since August 2025, targets Ukrainian government, military, energy, telecom and private‑sector organizations through spear‑phishing, fake CAPTCHA pages, and counterfeit adult‑dating sites.
Why It Matters for TPRM –
- AI‑augmented lures dramatically increase the success rate of social‑engineering attacks against third‑party vendors and their supply‑chain partners.
- Custom malware built with LLM assistance can evade traditional signature‑based defenses, raising the risk of data exfiltration from vendor environments.
- The focus on Ukrainian entities signals a geopolitical motive that may spill over to allied organizations and multinational supply chains.
Who Is Affected – Government & military agencies, energy & telecom providers, NGOs, and private enterprises with ties to Ukraine or Russian‑adjacent markets.
Recommended Actions –
- Review all vendor email security controls (DMARC, SPF, DKIM) and enforce strict attachment scanning.
- Conduct AI‑phishing awareness training for staff and third‑party contacts.
- Verify that endpoint detection platforms can detect PowerShell‑based RAT behaviors and enforce application whitelisting.
Technical Notes – Attack vectors include spear‑phishing (malicious ZIP/RAR via Google Drive/4sync), fake CAPTCHA/Cloudflare verification pages, and counterfeit Ukrainian‑themed websites. Malware families (LegionRelay, PhantomRelay) are PowerShell RATs capable of credential theft, screenshot capture, and exfiltration via Telegram/WhatsApp. No specific CVE is cited; the novelty lies in AI‑assisted code obfuscation tools (LOOKVALPS, DAYLIGHT, TEASOUP). Source: BleepingComputer