Russian authorities have detained three suspected members of VasyGrek, a cybercriminal group also known as Fluffy Wolf, following an investigation into malware attacks and financial theft. Police say they have dismantled the group’s infrastructure and seized electronic equipment used in its operations.
According to Russia’s Interior Ministry, the suspects allegedly targeted businesses through phishing campaigns designed to steal money from corporate bank accounts. The group’s activities reportedly date back to at least 2016, with most of its known victims located in Russia.
One of the incidents described by investigators occurred in September 2025, when an employee at an unidentified company received an email disguised as routine business correspondence. The attachment appeared to contain a financial reconciliation document but instead executed malicious software when opened.
Investigators allege that the attackers subsequently gained remote access to the employee’s computer and the company’s online banking system. They transferred more than 660,000 rubles, approximately $8,000, into accounts they controlled.
The operation relied on phishing websites impersonating financial and accounting services, along with servers hosted outside Russia. Authorities said the suspects also obtained remote administration tools from underground marketplaces to maintain access to compromised computers.
Police searched residential and office premises associated with the suspects, confiscating computers, communications devices, and other potential evidence. According to Russian media reports, the suspected leader was placed under house arrest, while two alleged accomplices were released under travel restrictions.
Cybersecurity researchers have separately documented an expansion of VasyGrek’s operations. Kaspersky reported detecting more than 100 attempted attacks attributed to the group between January and September 2026, targeting organizations in Russia, Belarus, and Kazakhstan.
The campaigns primarily focused on metallurgical businesses, industrial suppliers, and government agencies. Companies operating in healthcare, agriculture, finance, energy, and the oil and gas industry were also among the targets.
Researchers found that VasyGrek used malicious attachments disguised as financial documents to distribute information-stealing malware and remote access trojans. Its reported toolkit included MetaStealer, PureCrypter, WarZone RAT, and other commercially available malicious programs.
Some campaigns also deployed a Golang-based backdoor capable of executing commands on infected devices. Kaspersky said the attackers used multistage infection methods and legitimate online services to host malicious components, making their activity harder to detect and investigate.
The three suspects face allegations involving financial theft and the development or distribution of malware. According to reporting by Recorded Future News, the theft charge carries a potential prison sentence of up to ten years, while the malware-related charge carries up to five years.
Russian authorities say the group’s infrastructure has been disrupted, but it remains unclear whether other VasyGrek members are still active or whether the arrests have permanently ended its operations.