Inside the GREYVIBE Threat Actor Group: A Hybrid Espionage Menace

GREYVIBE is a Russia-aligned threat actor active since August 2025 against Ukrainian targets, running multiple concurrent campaigns (PhantomMail, PhantomClick, PrincessClub, DroneLink) that use social engineering, fake verification pages, malicious Android apps (FallSpy), and modular backdoors (PhantomRelay, LegionRelay); operators leverage generative AI to craft lures and accelerate code development, blending state-aligned objectives with criminal behaviors.