In a significant move against domestic cybercrime, Russian authorities have dismantled the infrastructure of the **VasyGrek** (aka **Fluffy Wolf**) cybercriminal group and arrested three suspected members. This operation, conducted with assistance from cybersecurity firm **Kaspersky**, marks a rare public enforcement action against a Russian-speaking hacking collective operating within the country's borders. ### Group's Modus Operandi Active since at least 2016, **VasyGrek** has primarily targeted Russian organizations through sophisticated phishing campaigns. Their tactics involved crafting convincing emails to steal credentials, gain unauthorized access to corporate networks, and deploy various forms of malware. The group's operations were supported by an extensive network of phishing websites impersonating financial and accounting services, often hosted on servers abroad. They also reportedly acquired remote administration tools from dark web marketplaces to facilitate covert access to victim systems. ### Details of the Crackdown Russia's Interior Ministry, through spokesperson **Irina Volk**, confirmed the arrests. The alleged leader of **VasyGrek** has been placed under house arrest, while two suspected accomplices were released under strict travel restrictions. Police searches of the suspects' homes and offices yielded computers, communications equipment, and other crucial evidence. **Volk** also noted that the group's activities had drawn the attention of law enforcement agencies in Russia, the United States, and Europe, though specifics regarding international cooperation were not provided. ### A Typical Attack Scenario Investigators described a representative attack where, in September 2025, an accounting department employee received a malicious email disguised as a legitimate financial document from a business partner. Upon opening the attachment, the attackers allegedly gained remote access to the computer and the company's online banking system, subsequently siphoning over 660,000 rubles (approximately $8,000 USD) into accounts under their control. ### Expanding Reach and Broader Targets The crackdown comes as **VasyGrek** appeared to be expanding its operational scope beyond Russia. **Kaspersky**'s research, published concurrently with the arrests, revealed over 100 attempted attacks attributed to the group between January and September 2026. These attacks targeted organizations not only in Russia but also in Belarus and Kazakhstan. The group's expanded target list included: * Metallurgical companies * Wholesale suppliers of raw materials and industrial goods * Government agencies * Organizations in the healthcare, oil and gas, energy, finance, and agriculture sectors. **Kaspersky** characterized **VasyGrek** as a financially motivated group heavily reliant on targeted phishing and remote access malware to compromise corporate systems. ### Legal Ramifications The suspects face serious charges, including theft and the creation or distribution of malicious software. If convicted, they could face up to 10 years in prison for theft and up to five years for the malware-related charges. While the Interior Ministry has declared the group's hacking infrastructure dismantled, the long-term impact on **VasyGrek**'s operations remains to be seen.