Russian authorities have arrested three suspected members of the VasyGrek threat group, also known as Fluffy Wolf, and dismantled their criminal infrastructure This article explores attackers sent phishing. . The Ministry of Internal Affairs of the Russian Federation (MVD) stated that the group's members are suspected of embezzling funds from organizations' accounts and creating, distributing, and using malicious software.
In a September 2025 incident highlighted by the ministry, attackers sent a phishing email to an unnamed organization, impersonating business correspondence and instructing recipients to open a reconciliation report that triggered the execution of malware. The incident resulted in losses of 660,000 rubles ($8,000) from the organization's bank account, with the attackers transferring the funds to accounts under their control.
The attacks exploited a large network of phishing domains that mimicked financial and accounting service websites, as well as servers in foreign countries. The group uses off-the-shelf tools like MetaStealer, PureCrypter, PureLogs Stealer, WarZone RAT, XMRig, BurnsRAT, PureHVNC, PureRAT, Pay2Key, and PowerLoader, as well as legitimate remote access software such as Remote Utilities.
In a recent report, Kaspersky disclosed that over 100 targeted attacks were carried out by VasyGrek against organizations in Russia, Belarus, and Kazakhstan from January to September 2026. This development follows BI.ZONE's detection of multiple attacks targeting Russian organizations using malware families like LxBase RAT, CoreRAT, and NightStrike RAT.
