Executive Summary
WithSecure attributes ongoing attacks on Ukraine since August 2025 to GREYVIBE, a Russian-speaking group using AI-powered tooling.
What Happened
A previously undocumented threat actor dubbed GREYVIBE has been attributed to ongoing and persistent attacks targeting Ukraine and Ukraine-related entities since at least August 2025. GREYVIBE, per WithSecure, is assessed to be a Russian-speaking group operating broadly in the Russian time zone, with the activities aligning with Kremlin state interests, specifically when it comes to
Vulnerability / Attack Technique
AI-assisted espionage
Technical Mechanism
AI used across operations.
AI Security Category
AI-assisted attack
Part of the AI-Assisted Attacks topic.
RealGround Analysis
State-aligned groups are adopting AI.
Recommended Controls
- No specific action
Related RealGround Service
AI Red Teaming · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/05/new-russian-linked-greyvibe-targets.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.