01 — Summary
GREYVIBE — vibe-coding the kill chain
GREYVIBE is a Russia-nexus threat group that has targeted Ukraine and Ukraine-related entities since at least August 2025, with development and testing dating back to April 2025. WithSecure assesses with high confidence that its operators are Russian-speaking, working in the Moscow time zone, with lures, victimology, and objectives aligned with Russian state interests — chiefly intelligence collection tied to the Russia-Ukraine conflict.
The group's defining characteristic is the systematic use of generative AI — Ideogram AI, ChatGPT, and Google Gemini — for lure imagery, site building, obfuscator and full-stack RAT development, infrastructure setup, and post-compromise scripting. GREYVIBE operates five concurrent campaigns using PhantomRelay (PowerShell RAT), LegionRelay (lightweight PowerShell RAT), and FallSpy (Android spyware), all obfuscated with a suite of custom obfuscators including LOOKVALPS, LOOKVALJS, DAYLIGHT, and TEASOUP.
02 — Actor details
GREYVIBE — profile and tradecraft
Active campaigns and malware families:
GREYVIBE has targeted Ukraine and Ukraine-related entities since at least August 2025, with development and testing observable from April 2025. WithSecure assesses with high confidence that operators are Russian-speaking and active in the Moscow time zone. The group's lures, victimology, and collection objectives align with Russian state interests, primarily intelligence gathering tied to the Russia-Ukraine conflict. Targeting has since expanded to Moldova, Romania, Brazil, Venezuela, and Guinea — consistent with broader Russian intelligence interest areas.
GREYVIBE operates five simultaneous campaigns with distinct delivery mechanisms. PhantomMail delivers malicious ZIP/RAR archives via spear-phishing links to Google Drive and 4sync. PhantomClick uses ClickFix fake-CAPTCHA pages impersonating Zoom and LAPAS. PrincessClub combines fake Ukrainian social-club websites with fake female Telegram personas to lure targets into downloading malware. DroneLink uses drone-themed fake charity sites to deliver payloads. Nebo employs a Russian-language "SPO NEBO" lure targeting military-adjacent personnel.
Every campaign follows the same Windows execution chain: a lure triggers a bundle that runs a loader showing a decoy — a PDF, a fake error pop-up, or a lure site — while the infection proceeds silently. In the script-based chain, a VBScript launcher fires a hidden PowerShell script. Both paths deploy the primary Windows payloads: PhantomRelay, a PowerShell RAT using a two-stage fingerprint-then-client model over WebSockets, and LegionRelay, a lightweight PowerShell RAT communicating over a REST API. FallSpy is the Android spyware used in the PrincessClub and Nebo campaigns. PhantomRelay also achieves lateral spread via USB using hidden files and malicious shortcuts.
All payloads are obfuscated with GREYVIBE's custom obfuscator suite: LOOKVALPS (PowerShell), LOOKVALJS (JavaScript), DAYLIGHT, and TEASOUP. The PhantomRelayLite base variant adds SAWDUST and CRUDEDUST components which patch AMSI and tamper with the ETW provider to blind Windows telemetry and bypass script-block logging. Persistence is maintained primarily through scheduled tasks driven by a watchdog script, with a short-lived Startup folder shortcut variant as a secondary mechanism.
GREYVIBE achieves privilege escalation through three techniques: shortcut hijacking that fires a UAC prompt from a trusted icon; a CMSTP-based UAC bypass (cmstp.exe with a custom .INF file); and a custom .NET component masquerading as "Windows Update" that baits a UAC approval to re-register LegionRelay's scheduled task as SYSTEM. For lateral movement, operators enable persistent RDP, create hidden local administrator accounts concealed via the SpecialAccounts\UserList registry key, and share local disks over SMB.
PhantomRelay C2 has rotated across EDIS Global, KVMka, Cloudzy, and the suspected bulletproof host Global Connectivity Solutions LLP. FallSpy and LegionRelay C2 infrastructure remained on Baxet Group Inc. servers with Russian-language admin panels. The defining characteristic of GREYVIBE is its systematic use of generative AI: Ideogram AI for lure imagery and site design, ChatGPT and Google Gemini for obfuscator and full-stack RAT development, infrastructure provisioning guidance, and post-compromise scripting — representing an operational maturity shift enabled by commercial AI tooling.
03 — Recommendations
What to do now
Four prioritised defensive actions for security and operations teams, ordered by detection impact.
Treat ZIP/RAR archives delivered via links to Google Drive, 4sync, and similar services as high-risk. Block or sandbox execution of double-extension files (e.g., .pdf.js, .XLS.js, .Docx.rar). Disable or tightly control the Windows Script Host (wscript.exe / cscript.exe) for JavaScript loaders. Apply mail gateway rules to flag messages with archive links to consumer file-sharing services targeting government or military recipients.
Enable PowerShell Constrained Language Mode, script block and module logging, and transcription. Hunt for conhost.exe launched with the --headless parameter spawning PowerShell, for Invoke-Expression on remotely fetched content, and for command-history suppression via Set-PSReadlineOption -HistorySaveStyle SaveNothing and Remove-Module PSReadline — both GREYVIBE tradecraft signatures for covering post-execution tracks.
Alert on creation of scheduled tasks that re-execute scripts on short intervals (e.g., one minute after creation, then every three minutes). Hunt for tasks or loaders masquerading as vendor utilities — Razer, AMD, Adobe, "System Health Service," "Windows Check Updater." Inspect %ProgramData% and %LOCALAPPDATA% staging directories and Startup folder shortcuts for dropped .ps1 payloads, including SysCheckupService.ps1, RzUpdateManager.ps1, and WUDFHost.ps1.
Set UAC to always prompt and monitor for cmstp.exe invoked with custom .INF files. Watch for unexpected runas / RunAsInvoker shortcut modifications and treat sudden "Windows Update"-themed UAC prompts as suspicious. Audit creation of new local administrator accounts and accounts hidden via the SpecialAccounts\UserList registry key — a persistence mechanism GREYVIBE uses to conceal operator-created admin accounts from the Windows login screen.
04 — Indicators of compromise
IoCs — GREYVIBE / PhantomRelay / FallSpy / LegionRelay
Block or monitor all indicators below. All domains, IPs, emails, and URLs are defanged. The complete IoC set is also available via the WithSecure GitHub repository linked in References.
- 476334f9254ef0277b3462b6086655f38358a983b95991cfe4dcdd787740906a
- 78773eb9738bc3306a56bf39adc8212226479c24af8bf453be9d57103a91a904
- 62b585f36d4b14fa1e036feed692267aa098e7fc6cabb468a07997a025309299
- d60dd96ef92b43e2e4f955dd76448fc320c3f8445b661d9a4a3c40caca0aa8a5
- 687629ca9dc5b9b4bdf6c06fb1405449638b905f3a0c08bccac1c519ef22964d
- 8a7401444dd7c85b36ff7b1d0b36c5953692ef32dbeac7642fb7c1034bd8a726
- e81af6ae6862d905d8634a1f6e0a8893ba28e3ce61d12ccac020ef6fae802e8b
- 93111e523c38d98247a78a0d1d9ae163e9874acb70721f6fe0bf451c62fff283
- c823a315c2c78d2fd345c9b38bb7fc31a8cbff96c534ce9cc66c4e54bc7935a2
- 5115eca388860371d994457793f3a3c2c3d106da48ca12ecccb9432522c56cc3
- bd3f35b91bf83427e953d4cf531a0ee4b5ec9fc76b91700274effe0eba22510f
- 2abb318455960b446d034967c8403ec4339ba248b946f02cb1307ed7e6f4e327
- e8d0943042e34a37ae8d79aeb4f9a2fa07b4a37955af2b0cc0e232b79c2e72f3
- 42464c188cb8116b63938b3236504ec4ae31c7cadb9063085b30dd468d88860f
- 7ac06aaf0cdc1c1f0f14b0e8ccc550f9df20e79f3ce321207ec7a1867d6227ef
- f79b9d14b93d4c509386684f2aeebe53ab088e704b38b359db3ee7991942aec6
- 08eba15964cae61156a99d7ac33eedebdd6e9f3465dc77b5d8dc17dbedc2194a
- 18db95f2ae20a4ea86b3296f409eb3fc1131d2758c5bfdbda16a424a64e97d18
- e9634032df81334e9e960ab8b88ff05a0f7ec9c034dc012f816f09e23c18d41b
- 40f9399ea067d69c0985aecdc54beddbcb585d7f660606e5bb4be981811c28ba
- 9e443d773df5adf0ab9e622bb8179ce899f46b2166f2faa09d54a4622a9ac5cc
- 296932373f9c54fcf4eb285f81a17b1b93c5a96e5ff6dfa097b4d8c4b8f53b81
- 89e052bd182df8de5960784c663f962d44e058c8920a437f54ab75d03a7da3bd
- 9b7008c43814c7bf18375774bd2ed5f3bda9316dbef20b7e086fe921838f1186
- lapas[.]live
- zoomconference[.]click
- zoomconference[.]app
- princess-mens[.]fun
- princess-mens-club[.]com
- princessclub[.]click
- princessclub[.]best
- princessclub[.]online
- princessclub[.]cyou
- clubprincess[.]click
- frontforce[.]org
- ukrguard[.]org
- ukrbezpeka[.]online
- ironbrave[.]online
- ukrvarta[.]online
- edbo[.]linkpc[.]net
- edbo[.]publicvm[.]com
- edbo[.]work[.]gd
- dsszzi[.]linkpc[.]net
- declaration[.]linkpc[.]net
- goodhillsenterprise[.]com
- doct0rsim[.]com
- routinesyscheckup[.]com
- serotoninenterprise[.]com
- newstarcommunity[.]com
- jackscommunications[.]com
- fasterscommunications[.]com
- bsnowcommunications[.]com
- highfleetenterprise[.]com
- flyskyenterprise[.]com
- newsolutionsxsenterprise[.]icu
- nycpartnersenterprise[.]com
- chiselworksenterprise[.]com
- bluelagoonaenterprise[.]com
- neuromancersolutionsenterprise[.]icu
- aerobionix[.]com
- prosearium[.]net
- red-viper[.]com
- xpertlearninghub[.]com
- centrenergo[.]ukr[@]gmail[.]com
- centrenergo[.]ua[@]gmail[.]com
- office[.]dsns[.]dp[@]gmail[.]com
- kanc[.]kh[.]dsns[@]gmail[.]com
- office[.]cip[.]ua[.]gov[@]gmail[.]com
- office[.]gov[.]cips[@]gmail[.]com
- SysCheckupService.ps1
- SystemHealthSvc.ps1
- Configuration.ps1
- Configurate.ps1
- WUDFHost.ps1
- razer_update.log
- RzUpdateManager.ps1
- RzTelemetry.ps1
- %ProgramData%\WindowSystem
- %ProgramData%\Microsoft Windows
- C:\ProgramData\AMD\amd.ps1
- C:\ProgramData\BackUp\backup.ps1
- C:\ProgramData\Adobe\dfDgrr3.ps1
- %LOCALAPPDATA%\Razer Update (staging directory)
- 188[.]124[.]59[.]120
- 193[.]233[.]23[.]81
- 89[.]37[.]185[.]60[:]14000
- 74[.]112[.]102[.]120[:]14000
- 194[.]87[.]128[.]243[:]8000
- 194[.]87[.]108[.]110[:]8000
- 89[.]125[.]189[.]118[:]8000
- 89[.]125[.]189[.]85[:]8000
- 91[.]149[.]221[.]124[:]8000
- System Health Service
- Microsoft System Health Service
- Razer Synapse Service Helper
- Adobe working
- BackUp checker
- AMD Checker
- vikagogogo111
- nastyaa2001lov
- lilymihalyk
- hxxps[:]//storage[.]vlasiuk[.]kiev[.]ua/SW90D0qhta/матеріали_конференції[.]zip
- hxxps[:]//share[.]secureinfo[.]eu/get/ypMXMG58xH/Матеріали_конференції_доп[.]zip
- hxxps[:]//www[.]4sync[.]com/web/directDownload/tcqtmocL/MyE7HPqt[.]11b47e3a02edac898638b1906774210d
- hxxps[:]//drive[.]google[.]com/file/d/1RDXHPZtCzOXn6GN7UidXPo4qqZOA_UGd
- hxxps[:]//drive[.]google[.]com/file/d/12ffiBTWHm6GW8chJNIXuOeALPI82VnNs
- hxxps[:]//drive[.]google[.]com/file/d/1wkgvtTw_g5CvK84rWiHCr6HPZZb_OeKd
- hxxps[:]//drive[.]google[.]com/file/d/1aSIXJgZUT7AQEp5B_D7gyHRq74EFUxoz
- t[.]me/s/sdgsersergser
05 — MITRE ATT&CK TTPs
Tactics, techniques & sub-techniques
Full MITRE ATT&CK mapping for GREYVIBE across all five campaigns and both Windows and Android platforms.
