Russian authorities have arrested three suspected members of the threat group known as VasyGrek and dismantled its criminal infrastructure. The group is also known as Fluffy Wolf and has targeted Russian and international companies since 2016.
The Ministry of Internal Affairs of the Russian Federation, or MVD, says the suspects are believed to have stolen money from organizational accounts and created, distributed, and used malicious software. In one September 2025 case, the ministry says the attackers sent a phishing email to an unnamed organization, posed it as business correspondence, and told recipients to open a reconciliation report that launched malware. That incident led to losses of 660,000 rubles, or $8,000, and the money was moved to accounts the attackers controlled.
MVD said the attacks used a wide set of phishing domains that copied financial and accounting service websites, along with virtual servers in foreign countries. The ministry also said tools for covert remote administration were bought from the dark web. Russian authorities searched the suspects’ homes and the office premises they used for the operation, and they seized computer equipment, communication devices, and other items of evidentiary value.
VasyGrek tools and delivery methods
BI.ZONE and F6 describe VasyGrek as a financially motivated threat actor that first gets access through phishing emails with attachments made to look like financial documents. Its toolkit includes off-the-shelf stealers and trojans such as MetaStealer, PureCrypter, PureLogs Stealer, WarZone RAT, XMRig, BurnsRAT, PureHVNC, PureRAT, Pay2Key, and PowerLoader, along with legitimate remote access software including Remote Utilities.
A report published this week by Kaspersky says it recorded more than 100 attempted attacks by VasyGrek against organizations in Russia, Belarus, and Kazakhstan between January and September 2026. Those attacks also used decoy documents to drop a Golang backdoor that can run arbitrary commands on the infected device. The targeted organizations were mainly in the metallurgical sector, with wholesale suppliers of raw materials and industrial supplies and government agencies also affected. Other targets included healthcare, oil and gas, energy, finance, and agriculture organizations.
Nikita Nazarov, head of advanced threat research at Kaspersky, said the group expanded its attack geography from Russian organizations to include potential victims in Belarus and Kazakhstan this year. He also said the attackers used multi-stage infection schemes and legitimate online services to host malicious components, which hid their activity and made attack analysis harder.
Other Russian attack clusters
BI.ZONE also detected multiple attacks against Russian organizations that used LxBase RAT, CoreRAT, and NightStrike RAT. LxBase RAT is a commercial trojan that costs $119 per month and spreads through mass phishing campaigns. CoreRAT infection chains use phishing emails with 7zSFX and Rust droppers for delivery, and BI.ZONE attributes that activity to Core Werewolf, which it says overlaps with Vortex Werewolf to some extent.
NightStrike RAT attacks have been linked to a hacktivist-turned-cyber espionage cluster called Insolent Werewolf. Initial access in those cases comes from ClickFix-style attacks that deploy NetSupport Manager for remote access. BI.ZONE said Insolent Werewolf also uses Octowave Loader to deploy AdaptixC2 and Havoc post-exploitation framework implants on compromised systems, and that its malware set includes CapDoor and NightWire. The firm added that NightStrike, a C++ RAT, was probably created by the developer of NightWire because of similarities in coding style.
Licensed under CC BY-ND 4.0 International