Russian authorities have arrested three suspected members of the cybercrime group VasyGrek, also known as Fluffy Wolf, and dismantled the infrastructure used to carry out its operations. The arrests follow an investigation conducted with assistance from cybersecurity firm Kaspersky.
About VasyGrek
According to Russia's Interior Ministry, the group has been active since at least 2016 and primarily targeted Russian companies through phishing campaigns. The attackers used fraudulent emails to steal login credentials, gain access to corporate networks and deploy malicious software on victims' systems.
Attack tactic
The group operated an extensive network of phishing websites designed to impersonate financial institutions and accounting services. It also relied on servers hosted in foreign countries and purchased remote administration tools through dark web marketplaces. These tools allowed attackers to secretly access compromised computers and control them remotely.
One incident involved a company employee who received a phishing email in September 2025. The message appeared to come from a business partner and contained a malicious attachment disguised as a routine financial document. After the employee opened the attachment, the attackers allegedly gained remote access to the computer and the company's online banking system.
The cybercriminals transferred more than 660,000 rubles, approximately $8,000, from the company's bank account to accounts under their control, according to the Interior Ministry.
Phishing campaign goes beyond Russia
The investigation also revealed that the group's activities had expanded beyond Russia. In research published in November 2026, Kaspersky reported detecting more than 100 attempted attacks attributed to VasyGrek between January and September this year. The attacks targeted organisations in Russia, Belarus and Kazakhstan.
According to Kaspersky, the group primarily focused on metallurgical companies, wholesale suppliers of raw materials and industrial products, and government organisations. Other targeted sectors included healthcare, oil and gas, energy, finance and agriculture.
Kasppersky described VasyGrek as a financially motivated cybercrime operation that relied heavily on targeted phishing emails and malware capable of providing remote access to compromised systems.
About the investigation
After the investigation, Russian police searched the suspects' homes and offices, seizing computers, communication devices and other materials believed to be connected to the group's activities.
The alleged leader of the group has been placed under house arrest, while two other suspects have been released under travel restrictions, according to Interior Ministry spokesperson Irina Volk.
The Russian Interior Ministry said the group's infrastructure had been dismantled. However, it remains unclear whether the arrests will completely stop its operations or prevent other members from continuing similar attacks.
Read the original article:
Russia Takes Down VasyGrek Cybercrime Network After Years of Phishing Attacks