Russian law enforcement has apprehended three individuals suspected of involvement with VasyGrek (also known as Fluffy Wolf), a cybercrime group accused of abusing malicious software since 2016. The Ministry of Internal Affairs (MVD) reports the suspects allegedly embezzled funds from organizations and developed, distributed, and used malware to facilitate their attacks.
Phishing, Phony Domains and Hidden Malware
The group reportedly carried out a phishing campaign in September 2025 targeting an unnamed organization. The attackers sent a business-looking email prompting recipients to open a fake reconciliation report, which unleashed malware. Nearly 660,000 rubles (about US$8,000) were stolen as funds were shifted to accounts tied to the group.
The cybercriminals built an infrastructure that included phishing domains mimicking finance and accounting services, virtual servers abroad, and remote administration tools sourced from the dark web. Their malicious toolkit includes commercial and custom RATs (Remote Access Trojans) and stealers such as MetaStealer, PureLogs, Pay2Key, WarZone RAT, XMRig, and more—supported by legitimate remote access software like Remote Utilities.
Victims Across Industries and Borders
Security firm reports highlight that VasyGrek has launched over 100 attacks between January and September 2026 across Russia, Belarus, and Kazakhstan. Targets span the metallurgical sector, raw material wholesalers, industrial suppliers, government bodies, healthcare, energy and agriculture, as well as finance.
The group employed advanced infection chains using decoy documents to drop Golang backdoors capable of executing arbitrary commands. Attackers also leveraged multi-stage deployment techniques and legitimate services to hide malicious components and make analysis difficult.
Law Enforcement Operation and Seizures
Russian authorities executed searches at suspects’ homes and offices, seizing computers, communication devices, and other evidence. Part of the operation dismantled the infrastructure used by VasyGrek, including servers and tools central to its malware distribution and financial fraud operations.
Additional malicious software families have been flagged in associated campaigns: LxBase RAT, CoreRAT, and NightStrike RAT. These tools were delivered via phishing, often through email attachments or secondary droppers. Observers noted overlaps with other threat clusters like Core Werewolf and Insolent Werewolf, which share tactics or developer attribution.
Earlier, VasyGrek predominantly targeted domestic organizations. The recent shift includes expansions into Belarus and Kazakhstan, signaling broader regional ambition and operational scope.
What This Means
The arrest of these suspects and the dismantling of their infrastructure mark a rare move: domestic law enforcement cracking down on a financially motivated threat actor targeting domestic companies. For organizations in the industrial, governmental, and financial sectors, the case underscores the danger posed by phishing, phishing domains, RATs, and fake-document attacks—whether they come from inside the country or abroad. In the wider cyber threat landscape, seeing such a group expand beyond national borders into Belarus and Kazakhstan highlights shifting geographies of cybercrime. What to watch: whether law enforcement can trace the sources of stolen funds, expose supply chains for malware tools, and whether this crackdown deters similar operations for longterm change.
