Russian authorities have arrested three suspected members of the financially motivated hacking group VasyGrek, also known as Fluffy Wolf, and dismantled its criminal infrastructure.
The threat group has targeted Russian and international organizations since 2016, according to cybersecurity researchers. Russia’s Ministry of Internal Affairs (MVD) said the suspects are accused of stealing money from organizational bank accounts and creating, distributing, and using malicious software.
In one incident from September 2025, the attackers allegedly sent a phishing email disguised as business correspondence to an unnamed organization. The message instructed recipients to open a reconciliation report, which triggered malware execution. The attack resulted in the theft of 660,000 rubles, approximately $8,000, from the organization’s bank account. The stolen funds were subsequently transferred to accounts controlled by the attackers.
Investigators said the group operated an extensive network of phishing domains impersonating financial and accounting services and used virtual servers hosted abroad. The suspects also allegedly acquired covert remote administration tools through dark web marketplaces.
During the investigation, law enforcement officers searched the suspects’ residences and office premises used for the criminal operations. Authorities seized computer equipment, communication devices, and other potential evidence.
According to Russian cybersecurity firms BI.ZONE and F6, VasyGrek typically gains initial access through phishing emails containing attachments disguised as financial documents. Its toolkit includes commercially available information stealers and remote access trojans, including MetaStealer, PureCrypter, PureLogs Stealer, WarZone RAT, BurnsRAT, PureHVNC, PureRAT, and PowerLoader. Researchers have also linked the group to XMRig, the Pay2Key ransomware, and legitimate remote access software such as Remote Utilities.
A report published by Kaspersky this week said it recorded more than 100 attempted attacks attributed to VasyGrek against organizations in Russia, Belarus, and Kazakhstan between January and September 2026.
The attacks used decoy documents to deliver a Golang-based backdoor capable of executing arbitrary commands on compromised devices. Researchers said the group primarily targeted metallurgical companies, wholesale suppliers of raw materials and industrial goods, and government agencies. Other affected sectors included healthcare, oil and gas, energy, finance, and agriculture.
Kaspersky said the group’s geographical reach expanded in 2026, with potential victims increasingly located outside Russia. Researchers also observed multi-stage infection chains and the abuse of legitimate online services to host malicious components, helping the attackers conceal their activity and complicate analysis.
Separately, BI.ZONE reported multiple attacks against Russian organizations involving LxBase RAT, CoreRAT, and NightStrike RAT.
LxBase RAT, a commercial trojan priced at $119 per month, has been distributed through mass phishing campaigns. CoreRAT infections have involved phishing emails carrying 7zSFX archives and Rust-based droppers. The activity has been attributed to Core Werewolf, which researchers believe shares some operational overlap with Vortex Werewolf.
NightStrike RAT attacks have been linked to Insolent Werewolf, a cluster that evolved from hacktivism into cyber espionage. The group has used ClickFix-style techniques to deploy NetSupport Manager for remote access and Octowave Loader to install AdaptixC2 and Havoc implants. Its malware arsenal also includes CapDoor and NightWire.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Researchers believe NightStrike RAT may have been developed by the creator of NightWire, citing similarities in coding style. The use of multiple frameworks and custom malware allows attackers to adapt their tools to different targets and reduce the likelihood of detection.
