Russian Police Arrest Three Suspected VasyGrek Hackers and Dismantle Infrastructure

Russian authorities arrested three suspected members of the VasyGrek hacking group, also known as Fluffy Wolf, and dismantled its criminal infrastructure. The Ministry of Internal Affairs of the Russian Federation said the members are suspected of embezzling funds from the accounts of organizations and of creating, distributing, and using malicious software. The group has a history of targeting Russian and international companies since 2016.

Arrests and seized infrastructure

In one September 2025 case highlighted by the ministry, attackers sent a phishing email to an unnamed organization, masquerading it as business correspondence and instructing recipients to open a reconciliation report that triggered malware execution. The incident resulted in losses of 660,000 rubles ($8,000) from the organization's bank account, with funds transferred to accounts under their control. The ministry said the attacks used a vast network of phishing domains imitating financial and accounting service websites, along with virtual servers located in foreign countries, and that tools for covert remote administration were acquired from the dark web. Russian authorities conducted searches at the suspects' residences and office premises and seized computer equipment, communication devices, and other items of evidentiary value.

Tools and access methods

According to reports from BI.ZONE and F6, VasyGrek is a financially motivated threat actor that gains initial access by sending phishing emails with attachments disguised as financial documents. Its tools include MetaStealer, PureCrypter, PureLogs Stealer, WarZone RAT, XMRig, BurnsRAT, PureHVNC, PureRAT, Pay2Key, and PowerLoader, as well as legitimate remote access software such as Remote Utilities. Kaspersky recorded more than 100 attempted attacks by VasyGrek against organizations in Russia, Belarus, and Kazakhstan between January and September 2026. Those attacks also used decoy documents to drop a Golang backdoor capable of executing arbitrary commands on infected devices.

Targets and related activity

The Kaspersky report said attacks primarily singled out entities in the metallurgical sector, along with wholesale suppliers of raw materials and industrial supplies and government agencies. Other targets included organizations in healthcare, oil and gas, energy, finance, and agriculture. Nikita Nazarov, head of advanced threat research at Kaspersky, said the group expanded its attack geography, with potential victims this year also including companies from Belarus and Kazakhstan, and that attackers used multi-stage infection schemes and legitimate online services to host malicious components. Separately, BI.ZONE detected multiple attacks targeting Russian organizations using LxBase RAT, CoreRAT, and NightStrike RAT; LxBase RAT is a commercial trojan costing $119 per month and is distributed through mass phishing campaigns. CoreRAT infection chains use phishing emails containing 7zSFX and Rust droppers, and that activity has been attributed to Core Werewolf, which is assessed to share some overlap with Vortex Werewolf. NightStrike RAT attacks have been associated with Insolent Werewolf, which uses ClickFix style attacks to deploy NetSupport Manager and also utilizes Octowave Loader to deploy AdaptixC2 and Havoc post exploitation framework implants, with an arsenal that includes CapDoor and NightWire.

Sources: The Hacker News