GREYVIBE Threat Actors Use ChatGPT and Google Gemini to Scale Cyberattack Operations

Gbhackers •Divya • May 29, 2026

Threat actors are increasingly turning to generative AI tools such as ChatGPT and Google Gemini to accelerate cyberattack operations, lowering technical barriers and reshaping modern threat landscapes. A recent report by WithSecure highlights a Russia-linked threat group, tracked as GREYVIBE, that has systematically integrated large language models (LLMs) into its campaigns targeting Ukraine and related […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GREYVIBE: AI-Driven Cyberattacks Targeting Ukraine by Russian Hackers The GREYVIBE group, a previously unknown Russian hacking entity, has been actively targeting Ukrainian military, government, and civilian sectors since August 2025. Utilizing sophisticated AI tools like ChatGPT and Google Gemini, GREYVIBE has executed multiple campaigns involving spear-phishing emails, fake CAPTCHA pages, and fraudulent adult websites to deliver malware. Key malware tools include PhantomRelay, LegionRelay, and FallSpy, which facilitate espionage and data theft. The group has shown a blend of state-sponsored and cybercriminal tactics, indicating a lack of operational discipline. Despite their advanced use of AI, GREYVIBE has made significant operational security mistakes, exposing parts of their infrastructure. Their activities align closely with Russian state interests, particularly in the context of the ongoing conflict with Ukraine. 9 sources 73

Extracted Entities

GREYVIBE Threat Actors Use ChatGPT and Google Gemini to Scale Cyberattack Operations

The full story

Extracted Entities

APT Groups (1)

Countries (1)

Platforms (2)