Russian authorities have arrested three suspected members of VasyGrek and dismantled infrastructure used by the cybercrime group, The Hacker News reported on November 4. Russia’s Ministry of Internal Affairs (MVD) said the suspects were involved in stealing money from organizations’ accounts and creating, distributing and using malware.
The group, also called Fluffy Wolf, has targeted Russian and international companies since 2016. Kaspersky research cited in the report recorded more than 100 attempted attacks against organizations in Russia, Belarus and Kazakhstan between January and September 2026. Those figures describe attempted attacks, rather than confirmed compromises or a count of victims.
Financial documents used to deliver malware
The ministry highlighted a September 2025 incident in which attackers allegedly sent an unnamed organization a phishing email disguised as business correspondence. It instructed recipients to open a reconciliation report—a document used to compare financial records—which triggered malware execution. The ministry said the attackers transferred 660,000 rubles, approximately $8,000, from the organization’s bank account to accounts they controlled.
MVD described a network of phishing domains imitating financial and accounting service websites, supported by virtual servers hosted abroad. It said tools for covert remote administration were purchased on the dark web.
Research from Russian cybersecurity companies BI.ZONE and F6, cited by The Hacker News, characterizes VasyGrek as financially motivated. Their findings describe initial access through phishing emails carrying attachments presented as financial documents.
The group’s reported toolkit combines readily available malware with legitimate remote access software. It includes MetaStealer, PureCrypter, PureLogs Stealer, WarZone RAT, XMRig, BurnsRAT, PureHVNC, PureRAT, Pay2Key and PowerLoader, alongside Remote Utilities. Remote access trojans, or RATs, allow attackers to control infected computers.
Attacks extended into Belarus and Kazakhstan
Kaspersky’s report, published during the week of the arrest coverage, described attacks using decoy documents to deliver a backdoor written in Go. The backdoor can execute arbitrary commands on an infected device, giving attackers a way to direct further activity.
The attempted attacks primarily targeted metallurgy businesses, wholesale suppliers of raw materials and industrial supplies, and government agencies. Other targets operated in healthcare, oil and gas, energy, finance and agriculture.
Nikita Nazarov, Kaspersky’s head of advanced threat research, said the group had expanded beyond its previous primary focus on Russian organizations to potential victims in Belarus and Kazakhstan during 2026. He also described infection sequences involving multiple stages and the use of legitimate online services to host malicious components, helping conceal activity and complicate analysis.
Separate campaigns target Russian organizations
The Hacker News also cited BI.ZONE findings on separate attacks against Russian organizations involving LxBase RAT, CoreRAT and NightStrike RAT.
LxBase RAT, a commercial trojan priced at $119 per month, spreads through mass phishing campaigns. CoreRAT delivery chains use phishing emails with 7zSFX self-extracting archives and Rust-based droppers, programs that install further malware. Researchers attributed that activity to Core Werewolf, which they assess shares some overlap with Vortex Werewolf.
BI.ZONE associated NightStrike RAT attacks with Insolent Werewolf, a group described as having shifted from hacktivism to cyber espionage. Its initial access uses ClickFix-style lures, which trick users into taking actions that run malicious commands, to deploy the remote access application NetSupport Manager.
The researchers said Insolent Werewolf also uses Octowave Loader to deliver AdaptixC2 and Havoc implants for activity after compromise, alongside CapDoor and NightWire remote access trojans. They assessed that NightStrike, written in C++, was probably created by NightWire’s developer because of similarities in coding style.
In the VasyGrek case, Russian authorities searched the suspects’ homes and office premises used for the operations. Police seized computer equipment, communication devices and other items the ministry described as evidence.
