Russian Police Arrest 3 Suspected VasyGrek Hackers, Dismantle Criminal Infrastructure

VasyGrek's Operations

The VasyGrek threat group, also identified as Fluffy Wolf, has been a persistent cybercrime entity since 2016, primarily focusing on financial embezzlement. Their modus operandi involves sophisticated phishing campaigns, where attackers send emails disguised as legitimate business correspondence. These emails often contain attachments, such as reconciliation reports, that, when opened, trigger the execution of various malware strains. The group's arsenal includes a mix of off-the-shelf stealers and trojans like MetaStealer, PureCrypter, and WarZone RAT, alongside legitimate remote access software such as Remote Utilities, indicating a blend of custom and readily available tools to maximize their operational efficiency and evade detection. The MVD highlighted a September 2025 incident where a phishing attack led to the theft of 660,000 rubles ($8,000) from an unnamed organization, with funds subsequently transferred to accounts controlled by the attackers.

Russian authorities' investigation revealed that VasyGrek utilized an extensive network of phishing domains designed to mimic financial and accounting service websites. These domains, coupled with virtual servers located in foreign countries, provided a robust infrastructure for their illicit activities. The group also sourced tools for covert remote administration from the dark web, further illustrating their reliance on a combination of self-developed tactics and purchased resources. The recent law enforcement action involved searches at the suspects' residences and operational offices, leading to the seizure of critical evidence including computer equipment and communication devices, which will be instrumental in further understanding the group's full scope and potentially identifying other members or affiliates.

Geographic Expansion

Initially, VasyGrek's primary targets were organizations within Russia. However, recent intelligence from Kaspersky indicates a significant expansion in their attack geography. Between January and September 2026, Kaspersky recorded over 100 attempted attacks orchestrated by VasyGrek against entities in Russia, Belarus, and Kazakhstan. This geographical diversification suggests an effort by the group to broaden its victim pool and potentially exploit varying cybersecurity postures across different regions. The attacks during this period also incorporated more advanced techniques, such as using decoy documents to deploy a Golang backdoor capable of executing arbitrary commands on infected devices, indicating an evolution in their technical capabilities.

Beyond the expanded geographical reach, VasyGrek's targeting strategy has also diversified across sectors. While they primarily singled out entities in the metallurgical sector, they also targeted wholesale suppliers of raw materials and industrial supplies, as well as government agencies. Other affected sectors included healthcare, oil and gas, energy, finance, and agriculture. This broad targeting approach suggests that VasyGrek was opportunistic, seeking vulnerabilities across various industries rather than specializing in a single vertical. The use of multi-stage infection schemes and legitimate online services to host malicious components further aided their concealment and complicated attack analysis, as noted by Nikita Nazarov, head of advanced threat research at Kaspersky.

Broader Threat Landscape

This disruption of VasyGrek occurs within a dynamic and complex cyber threat landscape in Russia and neighboring regions. The article also mentions other active threat groups and malware families detected by BI.ZONE, such as LxBase RAT, CoreRAT, and NightStrike RAT. LxBase RAT, a commercial trojan, is distributed via mass phishing campaigns, highlighting a common initial access vector shared with VasyGrek. CoreRAT infection chains, attributed to Core Werewolf, utilize phishing emails with 7zSFX and Rust droppers, indicating a variety of delivery mechanisms employed by different actors.

Furthermore, the activity associated with NightStrike RAT has been linked to Insolent Werewolf, a group described as a hacktivist-turned-cyber espionage cluster. This group employs ClickFix-style attacks to deploy NetSupport Manager for remote access and utilizes Octowave Loader to deploy AdaptixC2 and Havoc post-exploitation framework implants. The mention of NightStrike RAT's potential creation by the developer of NightWire, based on coding style similarities, underscores the interconnectedness and shared development practices within the cybercriminal underground. These concurrent threats emphasize that while the VasyGrek arrests are a significant victory, the overall challenge of combating cybercrime remains substantial, with numerous other sophisticated groups continuing to operate and evolve their tactics.