Loading malware…
PhantomRelay is a modular PowerShell-based remote access trojan used in intrusion activity associated with the GREYVIBE threat cluster, which has targeted Ukraine and Ukraine-related entities since at least 2025. It is designed for Windows environments and operates through a two-stage execution chain in which an initial fingerprinting component profiles the host before launching the main client. The malware communicates with command infrastructure over WebSockets and supports remote execution of both PowerShell scripts and native Windows commands, enabling flexible post-compromise control.
PhantomRelay has been delivered through multiple social-engineering-driven intrusion chains, including spearphishing campaigns distributing malicious archives, ClickFix-style fake verification pages that trick victims into executing commands, and fraudulent lure websites used in broader espionage operations. Observed campaigns impersonated trusted Ukrainian institutions and services, and victimology included military, government, civilian, and business-related targets, including confirmed Ukrainian combatants in some related operations.
Multiple variants have been tracked, including PhantomRelayLite, PhantomRelayV1, and PhantomRelayV2. PhantomRelayV1 has been reported with a custom watchdog persistence mechanism. The malware has also appeared outside the core Ukraine-focused activity in unrelated cybercrime-linked delivery chains, suggesting either code sharing, reuse, or overlap with broader criminal ecosystems. Overall, PhantomRelay is best characterized as a PowerShell RAT used for host profiling, command execution, and sustained remote access in espionage-oriented campaigns aligned with Russian state intelligence interests, while also showing ecosystem overlap with cybercrime activity.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
PhantomRelay is a PowerShell-based RAT that uses a two-stage execution chain: a fingerprinting script, followed by the main RAT client. The RAT uses WebSockets to communicate with its C2 and supports execution of both PowerShell scripts and Windows commands.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
In early October 2025, the group briefly experimented with ClickFix-style fake CAPTCHA pages for initial malware delivery.
The group has leveraged multiple attack vectors, including spear-phishing e-mails, fake captcha pages and fraudulent Ukrainian adult club websites, to deliver malware to a diverse set of victims.
Initially, the threat actors initiated at least six unique email-based campaigns. These malicious messages deliver dangerous compression archives hosted on popular public storage services. Furthermore, the files contain automated script loaders that deploy localized documents.
victims were instructed, in Ukrainian, to run commands under the pretext of completing a Cloudflare-themed security verification process, while the executed command initiated a PhantomRelay infection chain in the background.
PhantomRelay, a PowerShell-based remote access trojan (RAT) designed to profile the host and run PowerShell scripts and Windows commands.
PhantomMail uses spear-phishing emails with links to malicious archives on Google Drive and 4sync, delivering JavaScript-based loaders...
Across these campaigns, the group has relied on custom developed obfuscators, loaders, and malware... WithSecure found evidence of AI assistance across multiple parts of the operation... obfuscation scripts...
The RAT uses WebSockets to communicate with its C2 and supports execution of both PowerShell scripts and Windows commands.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A modular PowerShell-based remote access tool that connects to command servers over secure WebSocket channels and supports delivery of additional modules for customized tasks.
A PowerShell-based remote access trojan used by GREYVIBE for victim compromise via spear-phishing and fake CAPTCHA/ClickFix-style lures.
A PowerShell-based remote access trojan used by GREYVIBE to profile infected hosts and execute PowerShell scripts and Windows commands. A variant, PhantomRelayV1, adds a custom watchdog persistence mechanism.
A modular PowerShell RAT delivered via multiple lure chains. It fingerprints victims, communicates over WebSockets, executes PowerShell and Windows commands, and loads additional scripts from C2. Variants include PhantomRelayLite, PhantomRelayV1, and PhantomRelayV2.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.