Russian Police Arrest 3 Suspected VasyGrek (Fluffy Wolf) Hackers, Seize Phishing Infrastructure
Russia's Ministry of Internal Affairs (MVD) announced the arrest of three suspected members of VasyGrek (aka Fluffy Wolf), a financially motivated threat group active since 2016 targeting Russian and international organizations. The group is accused of embezzlement and malware distribution, including a September 2025 phishing attack that netted attackers 660,000 rubles (~$8,000) via a fake reconciliation report email. Authorities searched suspects' homes and offices, seizing computers and communication devices, and dismantled phishing domains imitating financial/accounting services along with foreign virtual servers. The arrests coincide with new research from Kaspersky, BI.ZONE, and F6 detailing VasyGrek's expanded operations and related threat clusters active against Russia, Belarus, and Kazakhstan.
Detalhes técnicos
VasyGrek gains initial access via phishing emails with attachments disguised as financial documents, deploying off-the-shelf tools including MetaStealer, PureCrypter, PureLogs Stealer, WarZone RAT, XMRig, BurnsRAT, PureHVNC, PureRAT, Pay2Key, PowerLoader, and legitimate remote access software like Remote Utilities, acquired from dark web markets. Kaspersky recorded over 100 attempted attacks between January and September 2026, primarily against metallurgical, wholesale/industrial supply, and government sectors, with secondary targeting of healthcare, oil and gas, energy, finance, and agriculture. Recent campaigns used decoy documents to drop a Golang backdoor capable of executing arbitrary commands, leveraging multi-stage infection chains and legitimate online services for hosting to evade detection. Separately, BI.ZONE reported related but distinct activity by Core Werewolf (overlapping with Vortex Werewolf) using CoreRAT via 7zSFX and Rust droppers, and by Insolent Werewolf, a hacktivist-turned-espionage cluster using ClickFix-style lures to deploy NetSupport Manager, Octowave Loader, AdaptixC2, Havoc, CapDoor, and NightWire/NightStrike RAT. Additionally, LxBase RAT, a $119/month commercial trojan, is distributed via mass phishing.
Linha do tempo
-
Russian Police Arrest 3 Suspected VasyGrek (Fluffy Wolf) Hackers, Seize Phishing Infrastructure
ler a análise desta fonte ocultar
Russia's Ministry of Internal Affairs (MVD) announced the arrest of three suspected members of VasyGrek (aka Fluffy Wolf), a financially motivated threat group active since 2016 targeting Russian and international organizations. The group is accused of embezzlement and malware distribution, including a September 2025 phishing attack that netted attackers 660,000 rubles (~$8,000) via a fake reconciliation report email. Authorities searched suspects' homes and offices, seizing computers and communication devices, and dismantled phishing domains imitating financial/accounting services along with foreign virtual servers. The arrests coincide with new research from Kaspersky, BI.ZONE, and F6 detailing VasyGrek's expanded operations and related threat clusters active against Russia, Belarus, and Kazakhstan.
Technical Details
VasyGrek gains initial access via phishing emails with attachments disguised as financial documents, deploying off-the-shelf tools including MetaStealer, PureCrypter, PureLogs Stealer, WarZone RAT, XMRig, BurnsRAT, PureHVNC, PureRAT, Pay2Key, PowerLoader, and legitimate remote access software like Remote Utilities, acquired from dark web markets. Kaspersky recorded over 100 attempted attacks between January and September 2026, primarily against metallurgical, wholesale/industrial supply, and government sectors, with secondary targeting of healthcare, oil and gas, energy, finance, and agriculture. Recent campaigns used decoy documents to drop a Golang backdoor capable of executing arbitrary commands, leveraging multi-stage infection chains and legitimate online services for hosting to evade detection. Separately, BI.ZONE reported related but distinct activity by Core Werewolf (overlapping with Vortex Werewolf) using CoreRAT via 7zSFX and Rust droppers, and by Insolent Werewolf, a hacktivist-turned-espionage cluster using ClickFix-style lures to deploy NetSupport Manager, Octowave Loader, AdaptixC2, Havoc, CapDoor, and NightWire/NightStrike RAT. Additionally, LxBase RAT, a $119/month commercial trojan, is distributed via mass phishing.