Russian authorities have arrested three people suspected of belonging to VasyGrek, also known as Fluffy Wolf, and dismantled infrastructure allegedly used by the group. The Ministry of Internal Affairs of the Russian Federation said the suspects are suspected of stealing money from organizations’ accounts and creating, distributing, and using malicious software.
The ministry cited a September 2025 incident in which attackers allegedly sent a phishing email disguised as business correspondence. Recipients were prompted to open a reconciliation report, which launched malware. The organization lost 660,000 rubles, or about $8,000, after the attackers transferred the funds to accounts they controlled.
According to the ministry, the group used phishing domains mimicking financial and accounting services, along with virtual servers abroad. Its members also obtained covert remote-administration tools from the dark web. Police searched the suspects’ homes and the office premises they allegedly used, seizing computer equipment, communications devices, and other potential evidence.
Russian cybersecurity firms BI.ZONE and F6 have described VasyGrek as financially motivated and said it typically seeks initial access through phishing emails carrying attachments disguised as financial documents. Reported tools linked to the group include information stealers, trojans, and legitimate remote-access software.
Kaspersky said it recorded more than 100 attempted VasyGrek attacks against organizations in Russia, Belarus, and Kazakhstan from January through September 2026. The attacks used decoy documents to deliver a Golang backdoor capable of running commands on infected devices. Targets included companies in metallurgy and industrial supply, as well as government, healthcare, energy, finance, agriculture, and other sectors.
Kaspersky researcher Nikita Nazarov said the group’s potential targets had expanded beyond Russia to include organizations in Belarus and Kazakhstan. The report also noted the use of multi-stage infection methods and legitimate online services to host malicious components.
Sources: The Hacker News.