GREYBATTLE
GREYBATTLE is an Android malware family described as a bespoke variant of the Hydra banking trojan. In reporting on defense-sector targeting, it is associated with the Russia-linked cluster UNC5125 (also tracked as FlyingYeti/UAC-0149) and was used in highly targeted campaigns against Ukrainian frontline drone units.
Capabilities and intent (as stated): GREYBATTLE was used to steal credentials and data.
Delivery and lures (as stated): UNC5125 distributed GREYBATTLE via a website spoofing a Ukrainian military artificial intelligence company, and also used Google Forms-hosted questionnaires for reconnaissance of prospective drone operators. The malware is mentioned alongside MESSYFORK (COOKBOX) as being used for reconnaissance and malware delivery.
Targeting (as stated): Ukrainian frontline drone units / prospective drone operators in Ukraine, within broader defense/battlefield-technology targeting.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"UNC5125 ... leveraged an Android malware called GREYBATTLE, a bespoke version of the Hydra banking trojan, to steal credentials and data..."
UNC5125 targeted frontline drone units with Google Forms lures and malware like MESSYFORK and GREYBATTLE.
Techniques & procedures
2 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Hydra-variant tool used for reconnaissance and malware delivery.
Malware used by UNC5125 in campaigns targeting frontline drone units (no further functional detail provided).
Android credential/data-stealing malware described as a bespoke variant of the Hydra banking trojan, distributed via a spoofed website.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.