NARRATIVE: GREYVIBE — How a Russian Group Weaponized AI Against Ukraine Since August 2025

NARRATIVE: GREYVIBE — How a Russian Group Weaponized AI Against Ukraine Since August 2025

Introduction: An Unknown Name, a New Method — GREYVIBE Enters the History of Cyberwar

June 2026 — WithSecure Lifts the Veil on a Russian-Language Actor Changing the Rules of the Game

In June 2026, the Finnish cybersecurity firm WithSecure published an analysis that immediately circulated through intelligence and cybersecurity circles: a new Russian-language threat actor, named GREYVIBE, had been operating since August 2025 against Ukraine and targets linked to Kyiv. What made GREYVIBE particularly remarkable was not only its targets or methods — it was its tools. For the first time documented in a public report, a group linked to the Russian sphere was actively using generative artificial intelligence tools — ChatGPT, Gemini, Ideogram — as integrated components of its cybercriminal operations.

WithSecure positions GREYVIBE in a "grey zone" between state espionage and organized cybercrime, with a probable link to former Russian cybercriminals who were repurposed or co-opted by the services. This grey zone is itself revealing: Russia has developed an ecosystem in which the boundaries between state actors and criminal actors are deliberately blurred, allowing the state to benefit from criminal capabilities while maintaining plausible deniability. GREYVIBE is the latest example of this strategy.

GREYVIBE's AI Arsenal — ChatGPT, Gemini, Ideogram in the Service of Cyberwar

The use of ChatGPT and Gemini by GREYVIBE is documented across multiple phases of its operations. For generating phishing content: emails and messages written in flawless Ukrainian or English, personalized for specific targets, indistinguishable from legitimate communications. For malicious code development: exploitation scripts adapted to specific targets, generated and modified rapidly using the coding capabilities of LLMs. And for malware obfuscation: techniques to camouflage malicious code in order to evade detection by antivirus software and endpoint detection and response (EDR) systems.

Ideogram, an AI image generator, is used to create convincing visuals for phishing campaigns — logos of Ukrainian government organizations, official document letterheads, interfaces of legitimate applications reproduced with precision. This use of visual AI to create graphical decoys represents an additional step in the sophistication of GREYVIBE's operations. It demonstrates that AI is not being used as a single tool but as an integrated assistance ecosystem embedded in every phase of the cybercriminal operation.

The Origins of GREYVIBE — August 2025, A Silent Actor Takes Position

Why GREYVIBE Waited Until August 2025 — The Strategic Context of Its Activation

The choice of August 2025 as the starting point of GREYVIBE's operations is probably not random. In the summer of 2025, the war in Ukraine had entered a critical phase: the first deliveries of Western long-range weapons systems had shifted the dynamics of the conflict, discussions about a possible peace process were accelerating, and Ukraine was strengthening its institutional networks and diplomatic relations with its allies. This is precisely the moment when Russian intelligence had the greatest interest in penetrating Ukrainian networks and those of their supporters.

GREYVIBE did not appear from nowhere. It represents the repurposing or activation of actors who already existed in the Russian-language cybercriminal ecosystem — individuals with technical expertise, connections in the Russian offensive cybersecurity world, and the ability to rapidly integrate new tools like generative AI into their existing operations. The speed with which GREYVIBE integrated such sophisticated AI tools into its attack chains suggests prior adaptation of those tools even before their use in real operations.

The Russian "Grey Zone" — Between State Services and Organized Cybercrime

One of GREYVIBE's most important characteristics, according to WithSecure, is its positioning in the grey zone between state actor and criminal actor. This ambiguity is not accidental. Russia has developed, over many years, a model of partial privatization of cyberwar: cybercriminal groups are tolerated, sometimes subsidized, sometimes protected by Russian authorities, on condition that they direct a portion of their capabilities against targets aligned with Kremlin interests.

This model offers Russia several strategic advantages: deniability ("these are not state agents, they are independent criminals"), scalability (mobilizing dozens of groups without having to integrate them into the official military structure), and flexibility (deploying criminal capabilities adapted to specific contexts without the constraints of military doctrine). GREYVIBE is, in this framework, a typical example of the maturity of this Russian model — and of its capacity to integrate cutting-edge technologies into its operations.

PhantomRelay RAT and FallSpy — GREYVIBE's Malware Dissected

PhantomRelay RAT — A Next-Generation Remote Access Tool

Among the tools deployed by GREYVIBE in its operations against Ukraine, PhantomRelay RAT is the most documented. A RAT (Remote Access Trojan) is a piece of malware that allows an attacker to remotely control a compromised system: execute commands, exfiltrate files, record keystrokes, activate the camera and microphone, and maintain a persistent presence in the system. PhantomRelay integrates advanced obfuscation techniques that suggest the use of AI to generate or adapt its code based on the target environments.

What distinguishes PhantomRelay from conventional RATs, according to WithSecure's analysis, is its behavioural adaptation capability: it modifies some of its behaviours based on the security tools detected on the target system, dynamically reducing its detection surface. This adaptive capability was previously the preserve of the most sophisticated actors — state APT groups with significant resources. Its presence in the arsenal of a grey-zone group like GREYVIBE indicates a downward diffusion of advanced APT capabilities into the broader Russian cyber ecosystem.

FallSpy — Discreet Surveillance as a Secondary Objective

The second malware documented in GREYVIBE's operations is FallSpy, a discreet surveillance tool designed to collect information about compromised systems without triggering security alerts. FallSpy focuses on gathering metadata rather than massive data exfiltration: information about installed software, active network connections, system users, recently accessed files. This information allows the attacker to map the network and prepare more targeted operations.

The combination of PhantomRelay RAT + FallSpy reveals a coherent operational doctrine: first map (FallSpy), then exploit (PhantomRelay RAT). This two-stage approach is characteristic of professional intelligence operations, not a criminal group seeking immediate gain. It confirms WithSecure's reading of GREYVIBE's positioning: an actor whose primary objectives are intelligence-gathering and espionage, even if its operating method borrows from the methods and structures of organized cybercrime.

GREYVIBE's Attack Chains — From Phishing to Persistence

The Fake CAPTCHA Page — An Entry Vector That Exploits Digital Habits

One of the entry methods documented by WithSecure in GREYVIBE's operations is the use of fake CAPTCHA pages. CAPTCHA is a ubiquitous tool in everyday digital experience — a verification mechanism designed to distinguish humans from bots. GREYVIBE hijacks this familiarity by creating fake CAPTCHA pages that, instead of simply verifying that the user is human, trigger the execution of a malicious script or download an infected file in the background.

This technique — known as ClickFix or CAPTCHA abuse in cybersecurity jargon — is particularly effective because it exploits a mechanism users instinctively trust. A user who sees a CAPTCHA page thinks of a legitimate security check, not an exploitation attempt. This trust-based social engineering is at the heart of GREYVIBE's sophistication: using users' own security reflexes against them.

Fake Websites and Ukrainian Government Documents — the Precision of the Decoy

GREYVIBE also uses fraudulent websites that precisely imitate Ukrainian government portals, websites of non-governmental organizations supporting Ukraine, and communication platforms used by Ukrainian institutions. The precision of these imitations — made possible by the use of Ideogram and other visual AI tools to reproduce logos, letterheads, and layouts — is a qualitative leap beyond traditional phishing techniques.

These fraudulent sites serve as vectors to deploy PhantomRelay RAT and FallSpy onto victims' systems. But they also serve to collect credentials — usernames and passwords — that victims enter thinking they are authenticating on a legitimate site. These credentials can then be used for credential stuffing attacks against the real Ukrainian government systems, or sold on the dark web for future operations by other actors.

GREYVIBE's Targets — Who Moscow Wants to Surveil in Ukraine and Beyond

Ukrainian Civil Society as a Priority Target

GREYVIBE's documented targets reveal the intelligence priorities of the group, and by extension of its presumed handlers. Ukrainian civil society is a priority target: NGOs supporting Ukraine, humanitarian organizations, independent journalists, activists, and human rights groups. These targets may seem less strategic than government or military systems. But they have access to information of great value to Russian intelligence: international contact networks, communication channels between Ukrainian organizations and their foreign supporters, and information about displaced populations.

Ukrainian civil society is also an ideal target for influence operations: compromising an NGO's communications allows identifying and countering its information campaigns, mapping its foreign funding, and potentially infiltrating misleading information into its networks. In the information war Russia is waging parallel to the military war, having access to Ukrainian civil society networks is a first-order informational advantage.

Institutional Targets — Administrations, Critical Infrastructure, Media

Beyond civil society, GREYVIBE also targets second-tier Ukrainian government institutions — not necessarily the best-protected ministries, but regional administrations, local authorities, government agencies that manage sensitive data but have more limited cyber-defence capabilities. This weak-link targeting strategy is consistent with GREYVIBE's operations: seeking the least-defended entry points to progressively access higher-value information.

Independent Ukrainian media are also targeted. Compromising a newsroom's systems allows an actor like GREYVIBE to access protected sources, ongoing investigations, and communications between journalists and whistleblowers. This information has dual value: it allows Russia to anticipate and counter journalistic revelations that might embarrass the Kremlin, and to identify sources of information that Russia seeks to neutralize in its war against Ukrainian press freedom.

Ukraine Facing the AI Cyber Threat — Adaptations and Resilience

The SSSCIP and Ukrainian Cyber Defence — Holding Against an Amplifying Threat

Ukraine is not a passive victim in the face of GREYVIBE and other Russian cyber actors. Ukraine's State Service of Special Communications and Information Protection (SSSCIP) is one of the most experienced cybersecurity agencies in the world — forged in years of Russian cyberattacks that began well before February 24, 2022. Ukraine has developed unique expertise in rapid detection, incident response, and sharing threat information with allied partners.

The publication of WithSecure's report on GREYVIBE illustrates precisely this dynamic: Ukraine and its partners work collectively to document, analyze, and share information about new threats. This strategic transparency — making GREYVIBE's existence and methods public — deprives the group of part of its operational advantage and alerts other potentially targeted organizations. It is a form of collective defence that transforms each documented attack into a shared resource for improving everyone's defences.

Forced Innovation — How the War Teaches Ukraine to Defend Against AI

There is something deeply paradoxical about Ukraine's situation in the face of GREYVIBE: it is simultaneously the primary victim of the attacks and the experimental laboratory for defence against offensive AI. Because Ukraine is attacked first, because its defences are tested before those of any NATO country, it accumulates practical expertise in detecting and neutralizing AI-based attacks that its allies do not yet possess.

This expertise is a strategic resource that Ukraine actively shares with its partners, notably through exchanges with European and American CERTs (computer emergency response teams). The TrophyLab program, launched in June 2026 to share technical data on captured Russian weapons, has its cyber equivalent: information-sharing mechanisms on the tactics, techniques, and procedures (TTPs) of Russian cyber actors, including GREYVIBE, that benefit the entire alliance. Ukraine is not merely enduring cyberwar. It is drawing lessons from it and sharing them.

GREYVIBE Within the Broader Russian Ecosystem — One Actor Among Many

Void Blizzard, FortiBleed, GREYVIBE — The Constellation of Russian Cyber Actors

GREYVIBE does not operate in isolation. It is part of a rich and diverse Russian cyber ecosystem that includes state actors (APT28/Fancy Bear of the GRU, APT29/Cozy Bear of the SVR, Sandworm), grey-zone groups (GREYVIBE, Void Blizzard), and criminal actors who are occasionally hired out in the interests of the Kremlin. This ecosystem functions like a marketplace in which different capabilities are mobilized according to the operational needs of the moment.

The relationship between these actors is complex. They do not all operate under a single command. Some share tools and infrastructure; others operate in parallel without direct coordination. But they all converge toward the same global objectives: weakening Ukraine and its allies, collecting strategic intelligence, destabilizing democratic institutions, and preparing sabotage capabilities that could be activated in the event of future escalation. GREYVIBE, with its innovative use of AI, represents the technological frontier of this ecosystem.

AI as a Competitive Advantage in the Cyber Arms Race

GREYVIBE's use of AI is, for the Russian cyber ecosystem, a competitive advantage that risks spreading rapidly to other actors. Once a group demonstrates that it is possible to use ChatGPT to generate more effective phishing, to use Ideogram to create more convincing visual decoys, and to use LLMs to obfuscate malware more quickly — other groups adopt these methods. The speed of diffusion of innovations within the Russian cyber ecosystem is an often-underestimated aspect of the threat.

The Five Eyes warned on June 22, 2026 that these capabilities would become widespread "within months." GREYVIBE is live proof that this process is already underway. This is no longer about anticipating a future threat. It is about adapting to a present reality, understanding that GREYVIBE is not an isolated case but the precursor of a normalization of AI in offensive Russian cyber operations and those of their allies. The AI-based cyber arms race has already begun.

The Response of Tech Platforms — OpenAI, Google, and the Responsibility of AI Providers

What Are OpenAI and Google Doing About the Adversarial Use of Their Systems?

The revelation that GREYVIBE uses ChatGPT and Gemini in its operations directly raises the question of the responsibility of the companies that develop these tools. OpenAI and Google both have acceptable use policies that explicitly prohibit the use of their systems for criminal or malicious activities. These companies also invest in abuse detection mechanisms — systems that attempt to identify and block requests that appear to be aimed at generating malicious content.

But the operational reality is complex: GREYVIBE is not asking ChatGPT to "generate malware for me to attack Ukraine." It is using the legitimate capabilities of these tools in a diverted way — requesting professional writing assistance, coding help, image generation — combining them into a malicious operational pipeline in which no individual step is clearly illegal. It is the combination and the final objective that cause the problem, not each request taken in isolation. This reality makes detection extraordinarily difficult for platforms.

Toward Shared Responsibility — Governments, Tech Companies, and the Security Community

The response to the adversarial use of generative AI tools cannot rest solely on tech companies. It requires shared responsibility between platforms, governments, and the cybersecurity community. Platforms must invest in more sophisticated mechanisms for detecting malicious uses at scale. Governments must create regulatory frameworks that clearly define AI providers' obligations around preventing criminal uses. And the cybersecurity community — like WithSecure with its report on GREYVIBE — must continue to document and share examples of adversarial use to inform both defences and policies.

This three-way collaboration does not yet exist in a systematic manner. It is emerging on an ad hoc basis, driven by specific incidents and the goodwill of a few actors. Building a stable institutional architecture for this collaboration — with information-sharing protocols, clear legal obligations, and sustainable funding mechanisms — is one of the most urgent tasks for governments and tech industries in Western democracies. GREYVIBE is only the first visible warning. Others will follow.

The Implications for Ukraine's Allies — What GREYVIBE Announces for the West

Today's Ukrainian Targets, Tomorrow's Western Targets

The history of Russian cyberwar against Ukraine demonstrates a constant: methods tested against Ukraine are subsequently deployed against Ukraine's allies. The NotPetya attack of 2017, initially targeting Ukraine, caused massive damage to global corporations. Social engineering techniques developed against Ukrainian institutions have been adapted to target American, European, and Canadian organizations. GREYVIBE, with its AI-based methods, is probably no different.

Western organizations — particularly those involved in supporting Ukraine, in sanctions policy against Russia, or in strategic sectors related to defence — must prepare to be targeted by methods equivalent to those of GREYVIBE. Fake CAPTCHA pages, AI-generated phishing emails, fake government websites with Ideogram-generated logos — these attack vectors documented in Ukraine will sooner or later be adapted to target organizations in Europe and North America. The question is not whether. It is when.

Building Defences Now — The Concrete Measures GREYVIBE Demands

WithSecure's documentation of GREYVIBE is valuable not only for understanding the threat, but for preparing concrete defences. Organizations can take immediate steps: train personnel to identify fake CAPTCHA pages and fraudulent websites even if they are perfectly imitated; reinforce identity checks for communications that appear to come from official organizations; deploy behavioural detection solutions that identify abnormal activities rather than known malware signatures; and put in place out-of-band verification protocols for sensitive communications.

These measures are not new in principle. What is new is the urgency of their widespread deployment in the face of a threat that uses AI to bypass conventional defences. GREYVIBE has demonstrated that traditional anti-phishing filters are no longer sufficient against AI-generated decoys. The defensive response must integrate AI into its own detection mechanisms — which is precisely what cybersecurity companies like WithSecure and its peers are actively developing. But the race against the clock is real.

GREYVIBE and the Protection of Ukrainian Information — A Question of Sovereignty

Diplomatic Communications as a Target — What Moscow Is Trying to Intercept

Among the information GREYVIBE seeks to collect, Ukrainian diplomatic communications occupy a central place. Ukraine is constantly negotiating with its allies — on weapons deliveries, on the conditions of a future peace agreement, on European and NATO integration. Every confidential exchange between Kyiv and Washington, Paris, Berlin, or Ottawa has immense strategic value for Moscow, which seeks to anticipate allied positions before formal negotiations. GREYVIBE targets precisely the personnel and institutions participating in these exchanges.

This targeting logic confirms that GREYVIBE is not simply a classic cybercriminal operation aimed at financial gain. It is a strategic intelligence operation, oriented toward the information that can influence the decisions of Putin and the Kremlin on the conduct of the war and peace negotiations. Every intercepted diplomatic email, every Ukrainian negotiating position known in advance, is an informational advantage that Russia can convert into a concrete political or military advantage.

Personal Data Protection — Ukrainian Civilians as Indirect Targets

Beyond institutions, GREYVIBE also targets individual Ukrainians through their personal devices. The personal data of Ukrainian citizens — identity, location, contact networks, movements — is a precious resource for Russian intelligence services. This data can be used to identify people who have fled occupied territories, to map the family networks of resistance members, or to identify and target individuals present in the zones Russia seeks to control.

This civilian dimension of GREYVIBE's espionage is the least visible in technical analyses, but the most troubling from a humanitarian perspective. It means that GREYVIBE's malware is not only collecting military secrets or diplomatic information. It is also collecting information about ordinary people whose only crime is being Ukrainian in a country that Russia seeks to destroy. And this collection can have direct human consequences that cybersecurity tallies do not measure.

The WithSecure Analysis — What the Detection Methodology Tells Us

How WithSecure Detected GREYVIBE — The Chain of Indicators

WithSecure's detection of GREYVIBE is itself instructive. The analysts did not detect the group on the basis of a known malware signature — PhantomRelay RAT and FallSpy were new tools, with no signature in existing databases. Detection relied on behavioural indicators: abnormal activity patterns on targeted systems, connections to unusual command-and-control infrastructure, and stylistic similarities between the malicious code and tools previously attributed to Russian-language actors.

This approach based on TTPs (Tactics, Techniques and Procedures) rather than signatures is precisely what defences against AI-generated threats will need to adopt. When malware can be AI-generated with infinite variations of its code, signature databases become less relevant. What remains constant is behaviour: how the malware communicates, what resources it uses, what actions it performs on the host system. WithSecure detected GREYVIBE by listening to those behaviours. That is where the future of cyber detection lies.

The Publication of the Report — A Strategic Decision of Transparency

WithSecure's decision to publish its findings on GREYVIBE is itself a strategic decision worth analyzing. Making public a report on an active threat actor partially deprives analysts of the advantage of exclusive knowledge, but creates other benefits: it alerts potentially targeted organizations, allows other research teams to correlate their observations, and sends a signal to the actor itself that its infrastructure is identified and its methods are exposed.

This culture of responsible disclosure of threats — sharing information about adversarial actors with the security community rather than keeping it exclusively for commercial use — is a fundamental characteristic of the democratic cybersecurity ecosystem. It is a culture that adversarial actors do not share. And it is precisely this collaborative openness that gives the West a collective defensive advantage that the sum of individual capabilities would not produce.

The Impact on Public Perception — Making Cyberwar Understandable to Citizens

Cyberwar Remains Invisible to the General Public — A Communication Problem

One of the fundamental difficulties in fighting groups like GREYVIBE is public communication. Cyberattacks do not produce the visual criteria of media coverage. They generate no images of smoke, of destroyed buildings, of evacuated populations. They generate technical reports that fewer than 1% of the population can read. And yet their effects are real: stolen strategic information, compromised individuals, weakened institutions, a silent intelligence war being lost.

Bridging the gap between the technical reality of cyberwar and public perception is a democratic challenge. Citizens who do not understand cyber threats cannot push their governments to take them seriously. They cannot demand the necessary investments in cybersecurity. And they cannot develop the personal behaviours that reduce their own exposure. Journalism has a crucial role to play in this public education — translating the technicality of reports like WithSecure's into narratives that the general public can understand.

Naming the Responsible Parties — Public Narrative as a Counter-Intelligence Tool

Naming GREYVIBE publicly, describing its methods, explaining its targets and its implications — that is precisely what this narrative does. And it is a form of active counter-intelligence. A group like GREYVIBE thrives in obscurity: the more its methods are unknown to the organizations it targets, the more effective it is. Every article that describes its techniques, every training session that sensitizes employees to its attack vectors, every organization that reinforces its defences accordingly — reduces GREYVIBE's effectiveness.

The public narrative of cyberwar is not merely a journalistic act. It is a civic act. It contributes to collective security by illuminating zones that adversarial actors prefer to keep in shadow. It forces governments and organizations to account for their protection efforts. And it builds a public consciousness without which no cybersecurity policy can obtain the support needed for sustainable implementation.

GREYVIBE's Resources and Structures — What We Can Infer Without Certifying

What WithSecure's Analysis Allows Us to Infer About the Group's Resources

Without access to the full technical details of the WithSecure report, several elements allow us to infer something about GREYVIBE's resources and structure. The use of multiple AI tools (ChatGPT, Gemini, Ideogram) in parallel suggests a team with sufficient financial resources to maintain active subscriptions to several platforms. The development of two custom malware (PhantomRelay RAT and FallSpy) suggests at least a few skilled software developers within or in the service of the group.

The strategic coherence of the targets — Ukrainian civil society, independent media, second-tier government institutions — suggests a strategic direction that goes beyond the level of an opportunistic criminal group. Someone, somewhere, is defining GREYVIBE's operational priorities. And that someone thinks in terms of strategic intelligence, not immediate economic gain. These elements, taken together, sketch the profile of a group whose resources and structure are consistent with a para-state actor rather than a purely criminal group.

Uncertainty as an Epistemic Limit — What We Do Not Yet Know

I want to be honest about the limits of what we know. WithSecure documented GREYVIBE on the basis of forensic and behavioural observations. Attribution to the Russian sphere rests on converging indicators, not on concrete evidence such as the identification of a member or a seizure of infrastructure. The names PhantomRelay RAT and FallSpy are analytical designations, not necessarily the names the group itself uses. And the exact extent of the damage caused since August 2025 is not publicly known.

These uncertainties do not diminish the value of WithSecure's report. They are the normal limits of public cyber analysis. In a domain where adversarial actors do everything to mask their identity and methods, absolute certainty is rarely attainable. What matters is the robustness of the analysis based on available elements, and the epistemic caution not to go beyond what the evidence allows concluding. WithSecure maintained this analytical rigour. And that is precisely what lends credibility to its conclusions.

GREYVIBE in 2027 — Reasonable Projections on the Evolution of the Threat

The Predictable Adaptation of Methods — What AI Will Increasingly Enable

Based on documented trends, it is reasonable to project that GREYVIBE — or its functional successors — will continue to evolve in its use of AI. The probable next steps include: full automation of certain attack phases (from initial phishing to malware installation, without human intervention), the use of audio or video deepfakes for more sophisticated social engineering operations, and the integration of local AI models that require no connection to OpenAI or Google APIs, thus eliminating the risks of detection via those platforms.

These evolutions are not science fiction. They are the logical extension of already-documented capabilities. And they mean that the window to adapt defences before these evolutions are fully operational is limited. The Five Eyes alert on the acceleration of the AI threat within months is consistent with this trajectory of evolution. GREYVIBE version 2026 is alarming. GREYVIBE version 2027, with deepfakes and local models, will be in an entirely different category.

The Race Between Defence and Offence — A Fragile Balance to Preserve

The history of cybersecurity is the history of a permanent race between attackers and defenders. Each new attack technique is followed by a defensive adaptation; each defensive improvement is followed by an offensive evolution. The integration of AI on both sides of this race will accelerate the pace of adaptation cycles. AI-based detection systems will be countered by AI-generated attacks designed to fool them. And so on, in a spiral of technological escalation that goes beyond any historical precedent in terms of speed.

In this race, democracies have a potential advantage: open collaboration between researchers, companies, and governments. This advantage only materializes if this collaboration is actually practised with the same openness and the same speed that the threat demands. GREYVIBE reminds us that this advantage is not given — it is built, maintained, and defended through concrete decisions made now, not in 2030 strategic plans.

Conclusion: GREYVIBE as a Turning Point — AI in Cyberwar Is a Present Reality

August 2025 — The Month Cyberwar Changed Dimension

When cybersecurity historians analyse this period in a few years, August 2025 may be identified as the month when cyberwar crossed a threshold. Not because GREYVIBE was particularly devastating in its immediate effects — the direct documented damage remains to be precisely quantified. But because GREYVIBE represents the first detailed public documentation of an adversarial actor integrating generative AI into its entire operational chain, from decoy generation to malware obfuscation.

This threshold crossing has implications that go far beyond a single group or a single operation. It means that the technological bar for a sophisticated cyber operation has radically lowered. It means that conventional defence tools are less effective against AI-generated decoys. And it means that the acceleration predicted by the Five Eyes — "within months" — is already underway, not a future threat. GREYVIBE is the empirical proof of what intelligence agencies had anticipated. And that proof changes everything.

What We Owe Ukraine — Learning From Those Who Face the Threat First

Ukraine has been facing GREYVIBE since August 2025. Its cybersecurity experts, CERT teams, and institutions have accumulated practical experience in defending against these new methods that nobody else possesses. This experience is a strategic resource for the entire democratic alliance. Supporting it — financially, technically, by integrating Ukraine into cyber intelligence sharing circles — is not only an act of solidarity, but a direct strategic investment in everyone's security.

Zelensky has said, again and again, that what is happening in Ukraine today will happen elsewhere tomorrow if Russia is allowed to win. This truth applies to cyberwar too. What GREYVIBE is doing to Ukraine now, it will do to Europe and North America tomorrow. Learning from Ukraine, supporting Ukraine, integrating Ukrainian lessons into our defences — that is the most rational decision that democracies can make in the face of a threat that respects no borders and adapts faster than our institutions.

By Maxime Marquette, columnist

Columnist's transparency note

Editorial Positioning

This narrative is based on the publicly available information on GREYVIBE, as relayed by the cited sources from the WithSecure report. I did not have access to the original technical WithSecure report. The elements on PhantomRelay RAT and FallSpy come from descriptions in secondary sources — no personal technical analysis of these malware programs was conducted. My positioning is pro-Ukraine and pro-Western cyber-defence. The description of the Russian "grey zone" between state and cybercrime is based on open analyses from multiple security experts.

Sources and Limits

Attribution of GREYVIBE to the Russian sphere is that of WithSecure, based on technical and behavioural indicators. As with any attribution in cyberspace, it rests on probabilities and expert analyses, not on absolute certainties. The elements on GREYVIBE's specific targets are general — the available sources do not detail the individual organizations compromised, for victim protection reasons. The exact extent of the damage caused by GREYVIBE since August 2025 is not publicly known.

Sources

Primary sources

Ankura CTIX — Flash update on cyber threats including GREYVIBE — June 2, 2026

Cybersecurity Journal Canada — Daily cybersecurity briefing mentioning GREYVIBE — June 16, 2026

Aesop Academy — Five Eyes: frontier AI could reshape cyberattacks — June 23, 2026

Secondary sources

CNN — Five Eyes alert on AI and cyber threats — June 23, 2026

Brussels Times — At least 270 Belgian organizations targeted by ongoing Russian cyberattack — June 2026

Eastern Herald — Russian hackers exploit NATO firewalls — June 19, 2026