Russian authorities have disrupted the operations of a suspected cybercrime group known as VasyGrek, also called Fluffy Wolf, following an investigation into phishing attacks targeting Russian and international organizations. The Russian Ministry of Internal Affairs (MVD) said the group was allegedly involved in stealing funds from organizational bank accounts and creating, distributing and using malicious software. Authorities identified three suspected participants and conducted searches at their residences and office premises believed to have been used for the operations. Computer equipment, communication devices and other items considered relevant to the investigation were seized, while the group’s criminal infrastructure was dismantled. According to information published by Russian news agency Interfax, the alleged organiser was placed under house arrest, while two other suspected associates were ordered not to leave their residences. The case involves suspected financial theft and the use of malware, with the investigation focusing on the methods used to access victims’ systems and transfer funds.
The MVD described a September 2025 incident in which an employee of an unnamed organization received an email disguised as routine business correspondence from a business partner. The message contained an attachment presented as a financial reconciliation document. When the employee opened the file, malicious software was executed, allowing the attackers to gain remote access to the computer and the organization’s banking system. Investigators said more than 660,000 rubles, equivalent to approximately $8,000, were subsequently transferred from the company’s account to accounts allegedly controlled by the attackers. The ministry said the group relied on an extensive network of phishing domains designed to imitate financial and accounting service websites, alongside virtual servers hosted in foreign countries. It also stated that tools used for covert remote administration were acquired through dark web marketplaces. These methods allegedly enabled the operators to disguise malicious activity as ordinary business communication and gain access to systems used for financial transactions. The investigation also involved searches of locations associated with the suspected participants and the collection of digital evidence.
Cybersecurity companies BI.ZONE and F6 have previously described VasyGrek as a financially motivated threat actor that primarily uses phishing emails to gain initial access to organizational networks. The group has reportedly distributed malicious attachments disguised as financial documents and used a combination of commercially available malware, information-stealing tools and remote access software. Security researchers have associated its activity with several malware families, including MetaStealer, PureCrypter, PureLogs Stealer, WarZone RAT, BurnsRAT, PureHVNC and PureRAT. Other tools and components linked to its reported operations include PowerLoader and Pay2Key. In a separate assessment published on November 2, Kaspersky said it had recorded more than 100 attempted attacks attributed to VasyGrek against organizations in Russia, Belarus and Kazakhstan between January and September 2026. Researchers also identified an attack method involving decoy documents that delivered a Golang-based backdoor capable of executing commands on compromised devices. The findings indicate that the group has continued using phishing as an entry point while adopting more complex infection methods and additional tools to conceal malicious activity.
According to Kaspersky, the suspected campaigns primarily targeted organizations in the metallurgical industry, wholesale suppliers of raw materials and industrial equipment, and government institutions. Other sectors included healthcare, oil and gas, energy, finance and agriculture. The security company also noted that the group’s potential target geography had expanded beyond Russia to include organizations in Belarus and Kazakhstan. Researchers said attackers increasingly used multi-stage infection processes and legitimate online services to host malicious components, making it more difficult for defenders to identify and analyse suspicious activity. The latest law enforcement action follows years of reported activity associated with the VasyGrek name and comes amid wider concerns about phishing campaigns targeting businesses through routine financial correspondence. Separately, BI.ZONE has reported other malware-based campaigns against Russian organizations involving LxBase RAT, CoreRAT and NightStrike RAT, which have been associated with different threat clusters. These developments highlight the continuing use of phishing, remote access tools and malicious software in financially motivated cyber operations. The allegations against the VasyGrek suspects remain subject to the Russian investigation and legal process.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
