GreyVibe Blends GenAI Lures with Custom RATs

Containment and Immediate Remediation

If indicators of compromise are identified, security teams must act quickly to contain the threat and limit lateral movement:

• Enforce Constrained Language Mode: Enable PowerShell Constrained Language Mode (CLM) across all non-developer endpoints to limit dynamic API access and prevent the execution of obfuscated memory payloads.

• Disable Windows Script Host: Turn off wscript.exe and cscript.exe globally to neutralize JavaScript-based double-extension loaders, such as .js files masked as documents.

• Terminate Active Browser Sessions: If an endpoint is suspected of compromise, immediately invalidate and rotate all active session cookies, Telegram desktop tokens, and WhatsApp sessions to neutralize credential theft.

Anatomy of the GreyVibe Threat Group

GreyVibe is a Russia-nexus threat group whose activities closely align with Russian state interests. Extensive threat intelligence research indicates that the operators are Russian-speaking, with infrastructure and command-and-control servers configured to UTC+3 (Moscow time). While the group maintains a primary focus on Ukrainian or Ukraine-related organizations, its targeting has expanded to other global regions.

Despite their alignment with state espionage goals, researchers assess that GreyVibe lacks the rigid operational discipline characteristic of mature nation-state Advanced Persistent Threat (APT) groups. For instance, the deployment of cryptocurrency miners on compromised systems and the utilization of custom ISO builders linked to former members of cybercriminal organizations, such as UAC-0098 (a group with historical ties to TrickBot), point to a hybrid composition. The threat actor likely consists of active or former cybercriminals who have been co-opted or task-directed by state-affiliated entities.

The group compensates for any lack of sophisticated zero-day capabilities by mastering rapid, AI-driven social engineering. By utilizing platforms like ChatGPT, Google Gemini, and Ideogram AI, GreyVibe generates hyper-realistic text lures, localized phishing pages, and custom graphical assets that easily bypass traditional security awareness filters. To defend against such highly tailored threats, organizations should deploy advanced, continuous Security Awareness Training to help employees identify artificial intelligence-assisted lures.

The Five-Pronged Attack Architecture

The threat group runs five concurrent campaigns, each tailored to specific vectors and operational objectives:

1. PhantomMail (Spear-phishing Lures)

The PhantomMail campaign targets key personnel through highly specific spear-phishing emails containing malicious ZIP or RAR archives hosted on public cloud repositories, including Google Drive and 4sync. When opened, these archives extract double-extension JavaScript loaders, such as .pdf.js or .rar.js, which are heavily obfuscated using the custom LOOKVALJS or TEASOUP engines. To deceive the user, a decoy PDF or fake system error is displayed on screen while a script launcher silently executes in the background to install the PhantomRelay remote access trojan (RAT).

2. PhantomClick (ClickFix Redirection)

Leveraging fake CAPTCHA and ClickFix verification pages, this campaign redirects users to domains designed to look like legitimate services, such as Zoom and LAPAS. The victim is greeted with a fake Cloudflare verification prompt instructing them to press the Windows key + R, paste an encoded command into the Run dialog box, and press Enter. This social engineering trick directly executes a custom PowerShell command, bypassing browser sandbox protections to deploy the PhantomRelay RAT.

3. PrincessClub (Social Engineering & WebRTC)

Primarily targeting military and defense personnel, this campaign uses fraudulent dating portals and fake female Telegram personas to build trust. Recent iterations have incorporated WebRTC-based live call features to increase credibility before delivering the payload. For Android devices, victims are directed to download a malicious application package (princess.apk) containing the FallSpy spyware. For Windows devices, the actors deliver JavaScript-based loaders that deploy the LegionRelay RAT.

4. DroneLink (Military Charity Decoys)

The DroneLink campaign leverages fake military charity sites, specifically focusing on FPV drone fundraising. The underlying infrastructure and custom tooling are shared with the PrincessClub campaign. Once a user is enticed to download a fake software update or connectivity tool on the decoy site, the compromised system is loaded with LegionRelay alongside legitimate administrative utilities like WireGuard and ZAPiXDESK, which the actors use for session hijacking.

5. Nebo (Tactical Communication Clone)

The Nebo campaign features clone login pages that mimic Russian tactical military communications portals like SPO Nebo. This campaign targets frontline personnel, acting as a direct credential harvester and a gateway for secondary execution. Depending on the victim platform, the infection chain deploys FallSpy on Android or LegionRelay on Windows endpoints.

AI-Assisted Tooling and Malware Deep Dive

GreyVibe's tooling highlights their heavy reliance on large language models (LLMs) to write, optimize, and obfuscate code.

Custom Obfuscation Frameworks

The threat actor employs a custom development pipeline designed to generate new obfuscation variants to evade static signature detection:

• LOOKVALPS / LOOKVALJS: Early-stage PowerShell and JavaScript obfuscators that rely on randomized variable names, opaque predicates, and environment checks to break sandbox analysis.

• DAYLIGHT / TEASOUP: Advanced successors built with LLM assistance starting in late 2025 and early 2026. These engines systematically encrypt loader structures and make extensive use of dynamic API resolution to hinder reverse-engineering efforts.

PowerShell Windows Remote Access Trojans (RATs)

The group relies primarily on two PowerShell-based remote access trojans:

• PhantomRelay: A modular, WebSocket-based RAT. Upon initial execution, it performs extensive environment fingerprinting, validates system name white-lists to block sandboxes, and establishes an active WebSocket connection to its command-and-control server. The malware also includes a dedicated USB propagation module (WUDFHost.ps1) that drops launcher scripts in %PROGRAMDATA% iles to compromise connected storage drives.

• LegionRelay: A lightweight post-compromise RAT that communicates via standard REST APIs. LegionRelay supports screenshot capturing, file and directory enumeration, browser credential theft, and persistent RDP setups. It also exfiltrates local Telegram and WhatsApp session databases to allow the attackers to hijack instant messaging accounts without triggering multifactor authentication. Interestingly, because parts of LegionRelay's backend databases were developed with AI assistance, researchers identified design flaws that allowed investigators to intercept and expose portions of the group's infrastructure.

FallSpy Android Spyware

Deployed in mobile-focused campaigns, FallSpy is a specialized surveillance tool designed to collect comprehensive tactical intelligence. Once installed on a device, the spyware exfiltrates contact lists, SMS messages, call histories, real-time GPS coordinates, connected Wi-Fi SSIDs, device storage contents, and SIM card details.

MITRE ATT&CK Mapping

Analysis of GreyVibe's behavioral patterns reveals close alignment with the following MITRE ATT&CK techniques:

• T1566.002 (Phishing: Malicious Link): Delivering public cloud storage links via target emails.

• T1204.001 (User Execution: Malicious Link): Tricking targets into clicking malicious links on fake dating portals and military charity sites.

• T1059.001 (Command and Scripting Interpreter: PowerShell): Running PowerShell scripts as the primary engine for LegionRelay and PhantomRelay.

• T1027 (Obfuscated Files or Information): Relying on DAYLIGHT, TEASOUP, and LOOKVAL utilities to encrypt payload files.

• T1547.001 (Boot or Logon Autostart Execution): Creating persistent shortcut files within startup directories.

• T1113 (Screen Capture): Grabbing and transmitting Base64-encoded screen captures.

• T1539 (Steal Web Session Cookie): Hijacking local browser directories to capture active session tokens and bypass multi-factor security controls.

Endpoint Detection and Hunt Guidance

To detect GreyVibe activity within your environment, security operations teams should implement the following hunting queries and verification steps:

1. Headless Execution Hunt

Look for instances where conhost.exe is spawned with the --headless flag. This is an unusual execution behavior when initiated by local users or standard scripting interpreters and often indicates an automated script attempting to hide its graphical window.

2. Command History Suppression

Attackers use PowerShell commands to hide their tracks. Search process creation logs for command lines containing:

Set-PSReadlineOption -HistorySaveStyle SaveNothing

or

Remove-Module PSReadline

These commands prevent Windows from logging command history, a classic sign of active system tampering.

3. Persistent Registry Modifications

GreyVibe attempts to conceal newly created administrative accounts by hiding them from the Windows login interface. Monitor modifications to the following registry path:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList

Any unauthorized usernames added to this key should be investigated immediately as potential persistent backdoors.