GreyVibeThreat actor
GREYVIBE is a low-to-moderately sophisticated threat actor associated with Russian state interests, primarily targeting Ukrainian entities. The group employs custom malware like LegionRelay and PhantomRelay, utilizing techniques such as decoy-and-payload execution logic and systematic use of GenAI and LLMs throughout their operations.From MISP Galaxy
Last reported 8 days ago, by Risky Business News1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1027.018Invisible Unicode
“Invisible Unicode characters: With the rise of AI email assistants, threat actors are going back to their bag of tricks from the early 2000s and we're seeing a rise in attacks leveraging invisible Unicode characters.”
- T1505.003Web Shell
“The zero-day has been used to plant web shells on Nextcloud servers where the app was installed since at least September.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Risky Bulletin: Russia arrests DataSuckers hacking group“The campaign is linked to a group known as GreyVibe and UAC-0247 (UAC-0244).”
Indicators in its reports
named in the reports above- kevincollier.bsky[.]socialin 1 report
Copy this indicator · defanged
Thanks — we review every report.