Russian authorities have successfully apprehended three individuals suspected of being key members of the cybercriminal group known as VasyGrek. This group, also referred to as Fluffy Wolf, has been notorious for its cyberattacks on both Russian and international companies since 2016.
Details of the Arrest and Criminal Activity
The Ministry of Internal Affairs of the Russian Federation (MVD) announced the arrests, stating that the suspects are believed to have misappropriated funds from various organizations. They achieved this through the creation, distribution, and execution of malicious software. A notable incident from September 2025 involved a phishing attack on an unnamed organization, which resulted in financial losses amounting to 660,000 rubles ($8,000).
The attack was orchestrated using a vast array of phishing domains, designed to mimic legitimate financial and accounting service websites. These operations also involved virtual servers located abroad, with remote administration tools procured from the dark web.
Search Operations and Evidence Seizure
In a rare move by Russian law enforcement, searches were conducted at the residences and offices associated with the suspects. This led to the seizure of computer hardware, communication devices, and other crucial pieces of evidence. The operation underscores the severe financial threat posed by such cybercriminal groups.
Reports from cybersecurity firms like BI.ZONE and F6 characterize VasyGrek as a financially motivated threat actor. Their primary method of attack involves phishing emails with attachments disguised as financial documents, employing tools such as MetaStealer, PureCrypter, and various remote access trojans.
Impact and Broader Cybersecurity Concerns
According to Kaspersky, over 100 attempted attacks by VasyGrek were recorded from January to September 2026, targeting organizations across Russia, Belarus, and Kazakhstan. These attacks frequently involved decoy documents to deploy backdoor malware capable of executing arbitrary commands.
The primary targets included entities within the metallurgical sector and suppliers of raw materials. However, other sectors such as healthcare, energy, and finance were also affected. This year has seen the group’s geographical focus expand beyond Russian borders to include Belarusian and Kazakhstani companies.
BI.ZONE has also noted a rise in targeted attacks using malware strains such as LxBase RAT, CoreRAT, and NightStrike RAT. These attacks, attributed to different hacker clusters, highlight the ongoing evolution of cyber threats and the increasing sophistication of attack methodologies.
Moving forward, the dismantling of VasyGrek’s network is a significant step in addressing cybercrime. However, the continual emergence of new threat actors underscores the need for enhanced cybersecurity measures and international cooperation in combating these cyber threats.
