Russian authorities have detained three suspected members of the financially motivated VasyGrek cybercrime group and dismantled infrastructure allegedly used in phishing and malware attacks against businesses. The Russian Interior Ministry said the operation identified the group’s suspected members, with assistance from Kaspersky, and led to searches of homes and offices where police seized computers, communications equipment and other evidence. The Record reported the arrests on Nov. 3. [6]
VasyGrek, also known as Fluffy Wolf, is a Russian-speaking threat actor active since at least 2016. According to Kaspersky ICS CERT, recent campaigns used targeted phishing, GitHub links and backdoors against Russian organizations in construction, consulting, manufacturing, engineering, retail and e-commerce. Earlier reporting linked the group to attacks against companies in manufacturing, energy, agriculture, finance, information technology and other sectors. [16][18]
Investigators said the group operated phishing websites impersonating financial and accounting services and used servers hosted abroad. Members allegedly bought remote-administration tools on dark-web marketplaces to obtain covert access to victims’ computers and corporate systems. In a case cited by the ministry, an employee received a September 2025 message disguised as business correspondence; opening a malicious financial document allegedly gave the attackers access to the company’s online banking system, from which they transferred more than 660,000 rubles, or about $8,000, to accounts they controlled. [6]
The alleged organizer has been placed under house arrest, while two suspected accomplices were released under travel restrictions, according to Interior Ministry spokesperson Irina Volk. Authorities said the suspects face allegations involving theft and the creation, distribution or use of malicious software; the reported maximum penalties are up to 10 years for the theft charge and five years for the malware charge. The ministry has not publicly identified the suspects or provided independent technical indicators that would allow defenders to connect the arrests to specific malware samples.
Kaspersky said it detected more than 100 attempted attacks attributed to VasyGrek between January and September 2026, targeting organizations in Russia, Belarus and Kazakhstan. The group most frequently pursued metallurgical businesses, raw-material and industrial-goods suppliers and government agencies, although healthcare, oil and gas, energy, finance and agriculture organizations also appeared among the targets. [6] The campaigns described by Kaspersky relied on phishing and remote-access malware rather than a disclosed software vulnerability, and no CVE identifier, CVSS score, public exploit or CISA Known Exploited Vulnerabilities entry has been tied to this operation in the available reporting.
For defenders, the arrests are not proof that VasyGrek’s tooling or access has disappeared. Organizations in the affected sectors should treat unexpected accounting correspondence, links to external document repositories and password-protected archives as high-risk, verify payment instructions through a separate channel, enforce phishing-resistant multifactor authentication and monitor for unauthorized remote-administration software and unusual banking activity. The Interior Ministry said the group’s infrastructure had been dismantled, but whether the operation permanently ends VasyGrek activity remains unclear. [6]
References
- Russia dismantles infrastructure of VasyGrek cybercrime group, detains three suspects
- APT and financial attacks on industrial organizations in Q2 …
- NVD