MalwareUsed by 1 actor

FallSpy

FallSpy is an Android spyware family first observed in August 2025 and associated with the GREYVIBE threat cluster. It has been used in campaigns targeting Ukraine and Ukraine-related victims, including operations known as PrincessClub and Nebo. GREYVIBE’s activity has been assessed as aligned with Russian state intelligence interests in the context of the Russia-Ukraine war, while also showing ties to the broader cybercrime ecosystem.

FallSpy is designed to harvest sensitive information from compromised Android devices. Reported collection includes contact lists, call logs, installed application inventories, SIM-linked phone numbers, device and network information, Wi-Fi details, last-known location data, public-facing network information, and media files. Its role in observed operations is intelligence collection from mobile devices, particularly against victims reached through socially engineered lure infrastructure.

Observed delivery has relied on fraudulent websites and tailored social engineering. In the PrincessClub campaign, fake Ukrainian adult-club websites delivered FallSpy to Android users, while parallel Windows-targeted payloads were served to desktop victims. Operators also used fake female personas on Telegram and local dating channels to build trust and direct targets to lure sites or deliver malware directly. In the Nebo campaign, a FallSpy sample was crafted to mimic a Russian-language military login interface, apparently to deceive Ukrainian military personnel. Confirmed victimology linked to associated campaigns includes Ukrainian combatants, with broader GREYVIBE targeting spanning military, government, civilian, and business-related entities.

FallSpy forms part of a wider GREYVIBE malware ecosystem that also includes PhantomRelay and LegionRelay. Administrative artifacts associated with FallSpy have been observed in Russian language, consistent with broader indications that GREYVIBE operators and developers are Russian-speaking and operate broadly in the Moscow time zone.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

GREYVIBE

FallSpy is an Android spyware first observed in August 2025. It has been observed across several GREYVIBE-associated campaigns, including PrincessClub and Nebo.

via withsecurewithsecure.com

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

2 techniques

T1589Gather Victim Identity InformationEvidence1

For example, the custom FallSpy Android malware extracts local contact lists and call logs.

T1598Phishing for InformationEvidence1

The group has used fake female personas on Telegram, including via local dating channels, to build trust with victims before directing them to the lure sites or delivering malware directly.

Initial Access

2 techniques

T1189Drive-by CompromiseEvidence3

The group has leveraged multiple attack vectors, including... fake captcha pages and fraudulent Ukrainian adult club websites, to deliver malware... PrincessClub... fake Ukrainian adult-club websites that deliver Android spyware called FallSpy, or Windows-based RATs depending on the victim’s device.

T1566PhishingEvidence1

The group has leveraged multiple attack vectors, including spear-phishing e-mails, fake captcha pages and fraudulent Ukrainian adult club websites, to deliver malware to a diverse set of victims.

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

Across these campaigns, the group has relied on custom developed obfuscators, loaders, and malware... WithSecure found evidence of AI assistance across multiple parts of the operation... obfuscation scripts...

T1036MasqueradingEvidence3

Associated domains masqueraded as Zoom conference and LAPAS (Latvian Platform for Development Cooperation) websites.

Discovery

3 techniques

T1016System Network Configuration DiscoveryEvidence1

The malware presents decoy content to the victim while covertly collecting and exfiltrating information from the victim’s device, including contacts, call logs, installed applications, SIM-linked phone numbers, device and network information, Wi-Fi SSID, last-known location, public IP, and media files.

T1033System Owner/User DiscoveryEvidence1

T1082System Information DiscoveryEvidence1

PhantomRelay is a PowerShell-based RAT that uses a two-stage execution chain: a fingerprinting script, followed by the main RAT client.

Collection

2 techniques

T1123Audio CaptureEvidence3

Later iterations of the lure sites introduced a WebRTC-based live call feature, accessible only post-infection, that could capture victim audio and video, turning the lure site from a static decoy into a potential human intelligence (HUMINT) collection mechanism.

T1125Video CaptureEvidence3

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

LegionRelay is a lightweight PowerShell-based RAT that supports ... file exfiltration, screenshot capture, browser data theft, Telegram and WhatsApp data exfiltration...

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

security online infoNews

Jun 3, 2026

GREYVIBE Threat Actor Group: Russia Nexus Threat

Custom Android spyware used in the PrincessClub campaign to harvest private information from infected devices, including contacts and call logs.

security affairsNews

May 29, 2026

Meet GREYVIBE, the Russian-Linked Hacking Group Using AI to Target Ukraine and Still Making Rookie Mistakes

Android spyware delivered through fake lure websites and used in campaigns targeting Ukrainian victims, including military-themed deception.

the hacker newsNews

May 29, 2026

New Russian-Linked GREYVIBE Targets Ukraine with AI-Powered Cyberattacks

An Android spyware used in GREYVIBE campaigns to harvest sensitive data from compromised mobile devices.

withsecureNews

May 28, 2026

GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations | WithSecure™ Labs

An Android spyware used for surveillance and intelligence gathering. It displays decoy content while covertly collecting contacts, call logs, installed apps, SIM-linked numbers, device/network info, Wi-Fi SSID, location, public IP, and media files for exfiltration.

+1 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

FallSpy