Threat reportMalwareTL-2026-3532
LegionRelay: Russia-aligned UAC-0247 / GREYVIBE PowerShell RAT C2 Servers Targeting Ukraine
LegionRelay: Russia-aligned UAC-0247 / GREYVIBE PowerShell (TL-2026-3532), also tracked as LegionRelay, is a high-severity malware campaign, first published 2026-10-14. It is attributed to UAC-0247 (Russia) with medium confidence, affects Microsoft Windows (PowerShell-based implant), maps to 10 MITRE ATT&CK techniques (T1021.001, T1027, T1059.001), and is covered by 9 detection rules and 28 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 10MITRE ATT&CK
- Actors
- 2UAC-0247
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 28Indicators of compromise
Key facts for TL-2026-3532
- Threat ID
- TL-2026-3532
- Also known as
- LegionRelay, GREYVIBE, UAC-0247
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- UAC-0247, GreyVibe
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- ESPIONAGE
- Target sectors
- government administration, health, defense, military
- Target regions
- ukraine
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in LegionRelay: Russia-aligned UAC-0247 / GREYVIBE PowerShell
Malware and tooling: AGINGFLY, CHROMELEVATOR, DAYLIGHT, FallSpy, LegionRelay, PhantomRelay, RAVENSHELL, SILENTLOOP, TEASOUP, ZAPIXDESK, Chisel, LIGOLO-NG
How LegionRelay: Russia-aligned UAC-0247 / GREYVIBE PowerShell works
Team Cymru identified twelve LegionRelay C2 servers (five previously unidentified) fingerprinted by AS26383, port 8000, Uvicorn ASGI and the banner 'France Education'. LegionRelay is a lightweight PowerShell RAT using REST API methods for C2, likely developed with LLM assistance, used by a Russia-aligned cluster (tracked as UAC-0247 by CERT-UA and GREYVIBE by WithSecure) against Ukrainian government, municipal healthcare and Defense Forces targets.
LegionRelay is a lightweight PowerShell-based remote access trojan that communicates with its command-and-control server over REST API methods. It supports operator-issued PowerShell command execution, file enumeration and exfiltration, screenshot capture, browser data theft, Telegram and WhatsApp data exfiltration, and RDP access setup; additional functionality is delivered as operator-staged scripts after compromise. WithSecure (May 28, 2026) documents it as one of the implants of GREYVIBE, a Russian-speaking, Moscow-timezone group active since at least August 2025 whose lures, victimology and objectives align with Russian state interests (intelligence collection tied to the war in Ukraine). WithSecure also reports systematic use of generative AI (ChatGPT, Google Gemini, Ideogram) for lure imagery, obfuscators, RAT development, infrastructure and post-compromise scripting, with design flaws in LegionRelay that exposed backend functionality. The Team Cymru post is the source for the C2 infrastructure analysis and the UAC-0247 association; the link between the UAC-0247 CERT-UA reporting and GREYVIBE/LegionRelay is made by the Team Cymru report rather than independently confirmed in the other sources reviewed.
Team Cymru Scout analysis (published 2026-10-14) identified twelve C2 IPs observed between 2026-02-07 and 2026-06-15, all in AS26383, listening on TCP/8000 with a Uvicorn ASGI server, a login page common across the infrastructure and the distinctive banner 'France Education'. Activity intensified during March-April 2026. Delivery per Team Cymru and CERT-UA is humanitarian-aid-themed phishing emails with links; CERT-UA's UAC-0247 reporting (March-April 2026, advisory #6288271 as cited by Team Cymru) describes an LNK -> remote HTA -> scheduled-task EXE chain with shellcode injection into RuntimeBroker.exe and tooling including RAVENSHELL, AGINGFLY, SILENTLOOP, CHROMELEVATOR, ZAPIXDESK, RUSTSCAN, LIGOLO-NG, CHISEL and XMRig. WithSecure lists LegionRelay in the PrincessClub (fake adult-site lures) and DroneLink (fraudulent charity sites) campaigns, with PyInstaller/JavaScript loaders, DAYLIGHT (PowerShell, Oct 2025+) and TEASOUP (JavaScript, Mar 2026+) obfuscation. WithSecure notes suspected ties to the cybercriminal ecosystem (TrickBot, UAC-0098) but insufficient evidence of direct continuation. No CVE is involved; CVSS is not applicable.
MITRE ATT&CK techniques used in TL-2026-3532
Lateral Movement
T1021.001 Remote Desktop Protocol
Defense Evasion
T1027 Obfuscated Files or Information; T1218.005 Mshta
Execution
T1059.001 PowerShell; T1059.007 JavaScript; T1204.002 Malicious File
Command and Control
Collection
Credential Access
T1555.003 Credentials from Web Browsers
Initial Access
Affected products and versions in LegionRelay: Russia-aligned UAC-0247 / GREYVIBE PowerShell
- Microsoft — Windows (PowerShell-based implant)
Vulnerable versions: Windows endpoints with PowerShell enabled
Remediation for LegionRelay: Russia-aligned UAC-0247 / GREYVIBE PowerShell
Immediate actions
- Block and alert on the 12 LegionRelay C2 IPs on TCP/8000 at the perimeter and retro-hunt proxy/firewall/NetFlow logs from 2026-02-07
- Hunt for outbound connections to AS26383 hosts on port 8000 (Uvicorn ASGI, banner 'France Education')
- Hunt for PowerShell making REST-style HTTP calls to non-standard ports and for staged PowerShell scripts spawned from mshta.exe, wscript.exe or PyInstaller loaders
- Reset browser-stored credentials and Telegram/WhatsApp sessions on hosts where LegionRelay is found
Workarounds
- Block RDP exposure and alert on unexpected RDP enablement or new local accounts (LegionRelay RDP setup capability)
Longer-term hardening
- Restrict execution of LNK, HTA and JS files and of mshta.exe and wscript.exe for standard users (per CERT-UA mitigation)
- Enable PowerShell Script Block and Module logging and constrain PowerShell with Constrained Language Mode/AMSI
- Train staff at government and healthcare bodies on humanitarian-aid-themed phishing lures and fake CAPTCHA pages
- Use Team Cymru Scout query openports.banner = "France Education" asn = "26383" openports.port = "8000" to track new infrastructure
Timeline of LegionRelay: Russia-aligned UAC-0247 / GREYVIBE PowerShell
- GREYVIBE activity observed since at least August 2025 per WithSecure (month-level date)
- DAYLIGHT PowerShell obfuscator in use from October 2025 per WithSecure (month-level date)
- First LegionRelay C2 (194.87.128.243:8000) observed by Team Cymru
- Activity intensifies March-April 2026; CERT-UA reports UAC-0247 humanitarian-aid phishing against government and municipal healthcare (month-level date); TEASOUP JavaScript obfuscator in use from March 2026
- Infrastructure rotates rapidly: eight new C2 IPs appear between 2026-03-17 and 2026-04-21, several lasting only a day
- WithSecure publishes GREYVIBE report documenting LegionRelay, PhantomRelay and FallSpy
- Last observation of C2s 91.149.221.123 and 194.87.108.217 by Team Cymru
- Team Cymru publishes analysis of twelve LegionRelay C2 servers and the AS26383/port 8000/'France Education' fingerprint
Sources cited for LegionRelay: Russia-aligned UAC-0247 / GREYVIBE PowerShell
- LegionRelay: Ukraine Targeted by Five Previously Unidentified C2 Servers (Team Cymru, Will Thomas)
- GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations (WithSecure)
- WithSecure Labs GREYVIBE IOC repository
- New Russian-linked GREYVIBE targets (The Hacker News)
- From clinics to government: UAC-0247 expands cyber campaign across Ukraine (Security Affairs)
- Vibe-Coding the Kill Chain: The GREYVIBE Story (Hive Pro)
- Russia-aligned crime group GREYVIBE extensively uses AI in attacks (CSO Online)
- UAC-0247 Targets Ukrainian Clinics and Government in Data-Theft Malware Campaign
Detection coverage for TL-2026-3532
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3532 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.