Russian Police Arrest Suspected Members of VasyGrek Group

Three individuals suspected of belonging to the threat group known as VasyGrek, also called Fluffy Wolf, have been arrested by Russian police as part of a broader operation to dismantle the group’s criminal infrastructure.

The Ministry of Internal Affairs (MVD) said the suspects are “suspected of embezzling funds from the accounts of organisations, as well as creating, distributing, and using malicious software.” The action involved searches at the suspects’ homes and their office premises, with seizures of computers, communications gear and other evidentiary items. BI[.]ZONE and F6, citing Russian authorities, describe VasyGrek as financially motivated and known since 2016 for phishing-led intrusions.

Kaspersky’s newest field intelligence notes more than 100 attempted VasyGrek attacks against organisations in Russia, Belarus and Kazakhstan between January and September 2026, many using decoy documents to drop a Golang backdoor capable of arbitrary command execution. The campaign has targeted metallurgical firms, wholesale raw-material suppliers, government agencies and other sectors including healthcare, oil and gas, energy, finance and agriculture.

BI[.]ZONE’s analysis links VasyGrek’s toolkit to off‑the‑shelf stealers and trojans such as MetaStealer, PureCrypter, PureLogs Stealer, WarZone RAT, XMRig, BurnsRAT, PureHVNC, PureRAT, Pay2Key and PowerLoader, plus legitimate remote‑access software like Remote Utilities. The group has also leveraged multi‑stage infection chains and hosted malicious components on legitimate online services to hinder analysis, according to BI[.]ZONE and Kaspersky.

The MVD also described the attackers as having used phishing domains imitating financial sites and foreign‑hosted virtual servers, with covert remote administration tools procured from the dark web. The development coincides with BI[.]ZONE reporting other Russian organisations being targeted by LxBase RAT, CoreRAT and NightStrike RAT.