Russian police detain three suspects in VasyGrek phishing case
Russian authorities have arrested three people suspected of belonging to VasyGrek, also known as Fluffy Wolf, and dismantled infrastructure allegedly used by the financially motivated threat group. The Ministry of Internal Affairs of the Russian Federation (MVD) said the suspects are believed to have stolen money from organisational accounts and created, distributed and used malware.
The group has targeted Russian and international companies since 2016. In a September 2025 case cited by the MVD, attackers allegedly sent an unnamed organisation a phishing email disguised as business correspondence. Recipients were instructed to open a reconciliation report, which triggered malware execution and led to the transfer of 660,000 rubles, about $8,000, from the victim's bank account to accounts controlled by the attackers.
Phishing infrastructure and remote access
The MVD said the campaigns relied on a large network of phishing domains made to resemble financial and accounting service websites, alongside virtual servers hosted outside Russia. The ministry also said tools for covert remote administration had been obtained from the dark web.
Authorities searched the suspects' homes and office premises used in the alleged operations. They seized computer equipment, communications devices and other material considered relevant to the investigation. The operation is a comparatively unusual public law-enforcement action against a group associated with sustained phishing and malware activity.
BI.ZONE and F6 have assessed VasyGrek as a financially motivated actor that commonly gains entry through phishing attachments presented as financial documents. Its reported toolkit includes MetaStealer, PureCrypter, PureLogs Stealer, WarZone RAT, XMRig, BurnsRAT, PureHVNC, PureRAT, Pay2Key and PowerLoader, as well as the legitimate remote-access product Remote Utilities.
Expanded targeting across three countries
Kaspersky recorded more than 100 attempted VasyGrek attacks against organisations in Russia, Belarus and Kazakhstan between January and September 2026. The campaigns used decoy documents to deliver a Golang backdoor capable of executing arbitrary commands on an infected device.
Metallurgical organisations were the main targets, along with wholesale suppliers of raw materials and industrial goods and government agencies. Healthcare, oil and gas, energy, finance and agriculture organisations were also targeted. Nikita Nazarov, head of advanced threat research at Kaspersky, said the group had extended its geography beyond Russian organisations to include potential victims in Belarus and Kazakhstan.
Kaspersky also said the operators used multi-stage infection chains and legitimate online services to host malicious components, measures intended to conceal activity and complicate analysis. The arrest does not remove the underlying exposure created when a convincing financial-document lure reaches an employee's inbox.
Operational implication for organisations
For businesses in the affected sectors, the case reinforces the value of verifying unexpected payment and reconciliation documents through an independent channel before opening them. Email filtering, controls on unauthorised remote-access tools and rapid investigation of suspicious document execution remain practical safeguards against the techniques described by the MVD and security researchers.