WithSecure details GREYVIBE, a Russia-nexus cluster using ChatGPT and Gemini for lures, custom malware like PhantomRelay and LegionRelay, and espionage against Ukrainian targets since August 2025. The group blends cybercrime ties with state-aligned goals.