Russian authorities have arrested three suspected members of a threat group known as VasyGrek and dismantled its criminal infrastructure.
Also known as Fluffy Wolf, the threat actor has a history of targeting Russian and international companies since 2016.
The Ministry of Internal Affairs of the Russian Federation (MVD) said members of the group are “suspected of embezzling funds from the accounts of organizations, as well as creating, distributing, and using malicious software.”
In one September 2025 case highlighted by the ministry, the attackers are said to have sent a phishing email to an unnamed organization, masquerading it as business correspondence and instructing recipients to open a reconciliation report that triggered the execution of malware.
The incident resulted in losses of 660,000 rubles ($8,000) from the organization’s bank account, with the attackers transferring the funds to accounts under their control.
“The attacks utilized a vast network of phishing domains imitating financial and accounting service websites, as well as virtual servers located in foreign countries,” MVD said. “Tools for covert remote administration were acquired from the dark web.”
The rare law enforcement action saw Russian authorities conducting searches at the suspects’ residences and the office premises they used to conduct the operations. It also led to the seizure of computer equipment, communication devices, and other items of evidentiary value.
According to reports from Russian cybersecurity company BI.ZONE and F6, VasyGrek is assessed to be a financially motivated threat actor that gains initial access by sending phishing emails with attachments disguised as financial documents.
Some of the key tools in its arsenal include off-the-shelf stealers and trojans, like MetaStealer, PureCrypter, PureLogs Stealer, WarZone RAT, XMRig, BurnsRAT, PureHVNC, PureRAT, Pay2Key, and PowerLoader, as well as legitimate remote access software such as Remote Utilities.
In a report published this week, Kaspersky said it recorded over 100 attempted attacks orchestrated by VasyGrek against organizations in Russia, Belarus, and Kazakhstan between January and September 2026. These attacks have also been observed using decoy documents to drop a Golang backdoor capable of executing arbitrary commands on the infected device.
The attacks primarily singled out entities in the metallurgical sector, along with wholesale suppliers of raw materials and industrial supplies and government agencies. Other targets included organizations in the healthcare, oil and gas, energy, finance, and agriculture sectors.
“The group expanded its attack geography: while previously its primary target was Russian organizations, this year, potential victims also included companies from Belarus and Kazakhstan,” Nikita Nazarov, head of advanced threat research at Kaspersky, said.
“The attackers used multi-stage infection schemes and legitimate online services to host malicious components, which helped conceal their activity and hinder attack analysis.”
The development comes as BI.ZONE it detected multiple attacks targeting Russian organizations using malware families like LxBase RAT, CoreRAT, and NightStrike RAT.
While LxBase RAT, a commercial trojan that costs $119 per month, is distributed via mass phishing campaigns, CoreRAT infection chains make use of phishing emails containing 7zSFX and Rust droppers for delivery. The activity has been attributed to Core Werewolf, which is assessed to share some level of overlap with Vortex Werewolf.
Attacks deploying NightStrike RAT have been associated with a hacktivist-turned-cyber espionage cluster dubbed Insolent Werewolf. Initial access is achieved using ClickFix-style attacks to deploy NetSupport Manager to gain remote access.
“Insolent Werewolf also utilizes Octowave Loader to deploy AdaptixC2 and Havoc post‑exploitation framework implants in compromised systems,” BI.ZONE said, adding the group’s malware arsenal includes other remote access trojans like CapDoor and NightWire.
“A RAT written in C++, NightStrike has presumably been created by the developer of NightWire, based on similarities in coding style. Utilizing diverse frameworks and their own custom malware allows the adversary to tailor tooling to specific attack conditions and reduce the likelihood of detection.”
