GREYVIBE, a Russian-linked hacking group, has been targeting Ukraine with AI-assisted malware since at least August 2025, affecting various sectors including military, government, and business. Despite being tracked by security firm WithSecure, the group's tactics are not particularly sophisticated, but its persistence and use of AI tools compensate for skill gaps. The group's activities can be characterized as both a spy operation and a crime gang, with researchers identifying five distinct attack chains. Notably, GREYVIBE's use of AI highlights the evolving nature of threat actors' capabilities1. The implications of state-aligned activity, such as GREYVIBE's suspected links to Russia, shift the threat model from a purely criminal context to a geopolitical one, requiring a different approach to mitigation and defense. This development matters to cybersecurity practitioners because it underscores the need for a nuanced understanding of the threat landscape, where nation-state interests can intersect with criminal activity.