# LegionRelay: Russia-aligned UAC-0247 / GREYVIBE PowerShell RAT C2 Servers Targeting Ukraine

> Team Cymru identified twelve LegionRelay C2 servers (five previously unidentified) fingerprinted by AS26383, port 8000, Uvicorn ASGI and the banner 'France Education'. LegionRelay is a lightweight PowerShell RAT using REST API methods for C2, likely developed with LLM assistance, used by a Russia-aligned cluster (tracked as UAC-0247 by CERT-UA and GREYVIBE by WithSecure) against Ukrainian government, municipal healthcare and Defense Forces targets.

- **Published:** 2026-10-14T18:06:56Z
- **Last reviewed:** 2026-10-14T18:06:56Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3532
- **ID:** TL-2026-3532
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** UAC-0247 (Russia)
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

LegionRelay is a lightweight PowerShell-based remote access trojan that communicates with its command-and-control server over REST API methods. It supports operator-issued PowerShell command execution, file enumeration and exfiltration, screenshot capture, browser data theft, Telegram and WhatsApp data exfiltration, and RDP access setup; additional functionality is delivered as operator-staged scripts after compromise. WithSecure (May 28, 2026) documents it as one of the implants of GREYVIBE, a Russian-speaking, Moscow-timezone group active since at least August 2025 whose lures, victimology and objectives align with Russian state interests (intelligence collection tied to the war in Ukraine). WithSecure also reports systematic use of generative AI (ChatGPT, Google Gemini, Ideogram) for lure imagery, obfuscators, RAT development, infrastructure and post-compromise scripting, with design flaws in LegionRelay that exposed backend functionality. The Team Cymru post is the source for the C2 infrastructure analysis and the UAC-0247 association; the link between the UAC-0247 CERT-UA reporting and GREYVIBE/LegionRelay is made by the Team Cymru report rather than independently confirmed in the other sources reviewed.

Team Cymru Scout analysis (published 2026-10-14) identified twelve C2 IPs observed between 2026-02-07 and 2026-06-15, all in AS26383, listening on TCP/8000 with a Uvicorn ASGI server, a login page common across the infrastructure and the distinctive banner 'France Education'. Activity intensified during March-April 2026. Delivery per Team Cymru and CERT-UA is humanitarian-aid-themed phishing emails with links; CERT-UA's UAC-0247 reporting (March-April 2026, advisory #6288271 as cited by Team Cymru) describes an LNK -> remote HTA -> scheduled-task EXE chain with shellcode injection into RuntimeBroker.exe and tooling including RAVENSHELL, AGINGFLY, SILENTLOOP, CHROMELEVATOR, ZAPIXDESK, RUSTSCAN, LIGOLO-NG, CHISEL and XMRig. WithSecure lists LegionRelay in the PrincessClub (fake adult-site lures) and DroneLink (fraudulent charity sites) campaigns, with PyInstaller/JavaScript loaders, DAYLIGHT (PowerShell, Oct 2025+) and TEASOUP (JavaScript, Mar 2026+) obfuscation. WithSecure notes suspected ties to the cybercriminal ecosystem (TrickBot, UAC-0098) but insufficient evidence of direct continuation. No CVE is involved; CVSS is not applicable.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.007 JavaScript
- T1218.005 Mshta
- T1027 Obfuscated Files or Information
- T1555.003 Credentials from Web Browsers
- T1113 Screen Capture
- T1021.001 Remote Desktop Protocol
- T1071.001 Web Protocols

## Sources

- [LegionRelay: Ukraine Targeted by Five Previously Unidentified C2 Servers (Team Cymru, Will Thomas)](https://www.team-cymru.com/post/threat-hunting-legionrelay-c2-servers-ukraine)
- [GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations (WithSecure)](https://www.withsecure.com/en/resources-hub/w-labs/greyvibe/)
- [WithSecure Labs GREYVIBE IOC repository](https://github.com/WithSecureLabs/iocs/tree/master/GREYVIBE/)
- [New Russian-linked GREYVIBE targets (The Hacker News)](https://thehackernews.com/2026/05/new-russian-linked-greyvibe-targets.html)
- [From clinics to government: UAC-0247 expands cyber campaign across Ukraine (Security Affairs)](https://securityaffairs.com/190875/apt/from-clinics-to-government-uac-0247-expands-cyber-campaign-across-ukraine.html)
- [Vibe-Coding the Kill Chain: The GREYVIBE Story (Hive Pro)](https://www.hivepro.com/threat-advisory/vibe-coding-the-kill-chain-the-greyvibe-story)
- [Russia-aligned crime group GREYVIBE extensively uses AI in attacks (CSO Online)](https://www.csoonline.com/article/4178879/russia-aligned-crime-group-greyvibe-extensively-uses-ai-in-attacks.html)
- [UAC-0247 Targets Ukrainian Clinics and Government in Data-Theft Malware Campaign](https://lifeboat.com/blog/2026/04/uac-0247-targets-ukrainian-clinics-and-government-in-data-theft-malware-campaign)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3532