Russian authorities have announced the arrest of three individuals suspected of being members of the cybercrime group **VasyGrek**, also known as **Fluffy Wolf**. Concurrently, law enforcement has successfully dismantled the group's criminal infrastructure, marking a notable victory against a persistent threat actor. ### **VasyGrek's Modus Operandi** The Ministry of Internal Affairs of the Russian Federation (**MVD**) confirmed that the arrested individuals are suspected of embezzling funds from organizational accounts and creating, distributing, and utilizing malicious software. **VasyGrek** has been active since 2016, primarily focusing on financially motivated attacks. A case highlighted by the **MVD** from September 2025 involved a phishing email disguised as business correspondence. Recipients were instructed to open a reconciliation report, which in turn triggered malware execution. This particular incident led to losses of 660,000 rubles ($8,000) from the targeted organization's bank account, with funds subsequently transferred to accounts controlled by the attackers. According to the **MVD**, the group leveraged a broad network of phishing domains designed to mimic financial and accounting service websites, alongside virtual servers located in foreign countries. Tools for covert remote administration were reportedly acquired from the dark web. ### **Law Enforcement Action and Seizures** The law enforcement operation included searches at the suspects' residences and the office premises used for their illicit activities. Authorities seized computer equipment, communication devices, and other items deemed to be of evidentiary value, crippling the group's operational capabilities. Russian cybersecurity firms **BI.ZONE** and **F6** have previously analyzed **VasyGrek**, identifying it as a financially motivated threat actor. Their initial access typically involves phishing emails containing attachments disguised as financial documents. ### **Arsenal of Malware** **VasyGrek**'s toolkit is extensive, incorporating off-the-shelf stealers and trojans such as **MetaStealer**, **PureCrypter**, **PureLogs Stealer**, **WarZone RAT**, **XMRig**, **BurnsRAT**, **PureHVNC**, **PureRAT**, **Pay2Key**, and **PowerLoader**. The group also exploits legitimate remote access software like **Remote Utilities** to maintain persistence and control. **Kaspersky** reported over 100 attempted attacks by **VasyGrek** against organizations in Russia, Belarus, and Kazakhstan between January and September 2026. These attacks often utilized decoy documents to deploy a Golang backdoor capable of executing arbitrary commands on infected devices. The primary targets included entities in the metallurgical sector, wholesale suppliers of raw materials and industrial supplies, and government agencies. Other sectors affected were healthcare, oil and gas, energy, finance, and agriculture. Nikita Nazarov, head of advanced threat research at **Kaspersky**, noted, "The group expanded its attack geography: while previously its primary target was Russian organizations, this year, potential victims also included companies from Belarus and Kazakhstan." He added that the attackers employed multi-stage infection schemes and legitimate online services to host malicious components, effectively concealing their activities and hindering analysis. ### **Related Threat Activity** In related developments, **BI.ZONE** has detected multiple attacks targeting Russian organizations with malware families like **LxBase RAT**, **CoreRAT**, and **NightStrike RAT**. **LxBase RAT**, a commercial trojan, is typically distributed via mass phishing campaigns. **CoreRAT** infections, attributed to **Core Werewolf** (which may overlap with **Vortex Werewolf**), utilize phishing emails containing **7zSFX** and Rust droppers. Attacks deploying **NightStrike RAT** have been linked to **Insolent Werewolf**, a hacktivist group that has transitioned to cyber espionage. Initial access for these attacks is achieved through **ClickFix**-style methods to deploy **NetSupport Manager** for remote access. **BI.ZONE** further detailed that **Insolent Werewolf** employs **Octowave Loader** to deploy **AdaptixC2** and **Havoc** post-exploitation framework implants. Their malware arsenal also includes other remote access trojans such as **CapDoor** and **NightWire**. **NightStrike RAT**, written in C++, is believed to be developed by the creator of **NightWire** due to coding style similarities, demonstrating the adversary's ability to tailor tooling for specific attack conditions and evade detection.