Russian Police Arrest 3 Suspected VasyGrek Hackers, Dismantle Criminal Infrastructure
Russian authorities have arrested three suspected members of the VasyGrek hacking group and dismantled its criminal infrastructure.
Also known as Fluffy Wolf, the threat actor has a history of targeting Russian and international companies since 2016. The Ministry of Internal Affairs of the Russian Federation (MVD) said members of the group are "suspected of embezzling funds from the accounts of organizations, as well as creating, distributing, and using malicious software."
Attack Methods
In one September 2025 case highlighted by the ministry, the attackers sent a phishing email to an unnamed organization, masquerading it as business correspondence and instructing recipients to open a reconciliation report that triggered malware execution. The incident resulted in losses of 660,000 rubles ($8,000) from the organization's bank account.
"The attacks utilized a vast network of phishing domains imitating financial and accounting service websites, as well as virtual servers located in foreign countries," MVD said. "Tools for covert remote administration were acquired from the dark web."
Operation Details
The rare law enforcement action saw Russian authorities conducting searches at the suspects' residences and office premises. It also led to the seizure of computer equipment, communication devices, and other items of evidentiary value.
Threat Assessment
According to reports from Russian cybersecurity company BI.ZONE and F6, VasyGrek is assessed to be a financially motivated threat actor that gains initial access by sending phishing emails with attachments disguised as financial documents. Some of the key tools in its arsenal include off-the-shelf stealers and trojans like MetaStealer, PureCrypter, and WarZone RAT.
The group expanded its attack geography: while previously its primary target was Russian organizations, this year, potential victims also included companies from Belarus and Kazakhstan.
Attack Scope
In a report published this week, Kaspersky said it recorded over 100 attempted attacks orchestrated by VasyGrek against organizations in Russia, Belarus, and Kazakhstan between January and September 2026. The attacks primarily targeted entities in the metallurgical sector, along with wholesale suppliers of raw materials and industrial supplies and government agencies.
Other targets included organizations in the healthcare, oil and gas, energy, finance, and agriculture sectors. The attackers used multi-stage infection schemes and legitimate online services to host malicious components, which helped conceal their activity and hinder attack analysis.
Related
