Russia’s Ministry of Internal Affairs (MVD) announced on November 3 the arrest of three suspected members of VasyGrek, a financially motivated hacking group also known as Fluffy Wolf, and the dismantling of the group’s infrastructure. Security reporting describes the action as a rare move of this kind by Russian authorities.
What the MVD Says Police Seized and Whom They Detained
The ministry said officers searched residences and offices and seized computers and communication devices. It says the suspects embezzled funds from organizations’ accounts and created, distributed and used malware.
The MVD highlighted one case from September 2025. A phishing email posing as business correspondence led to the execution of malware and a loss of 660,000 rubles, about $8,000. The ministry said the attacks relied on phishing domains imitating financial and accounting sites, virtual servers hosted abroad, and remote-administration tools bought on the dark web.
Victims in Russia, Belarus and Kazakhstan
VasyGrek targeted organizations in Russia, Belarus and Kazakhstan. The group’s documented lures, such as phishing emails posing as business correspondence and domains imitating financial and accounting sites, were built around routine business workflows in those countries.
Tooling Documented by BI.ZONE and F6
Security firms BI.ZONE and F6 describe VasyGrek as active since 2016. They list a long set of tools used by the group: MetaStealer, PureCrypter, PureLogs, WarZone RAT, XMRig, BurnsRAT, PureHVNC, PureRAT, Pay2Key and PowerLoader. The mix covers information stealers, remote access trojans, a loader, a cryptocurrency miner and Pay2Key, which indicates a toolkit that served both theft and other revenue streams.
Kaspersky Counts More Than 100 Attempted Attacks
Kaspersky, in a report published this week, counted more than 100 attempted attacks by the group between January and September 2026 against Russia, Belarus and Kazakhstan. The targets were mostly metallurgy companies, raw-material wholesalers and government bodies. The company also saw attempts against healthcare, oil and gas, energy, finance and agriculture. In these attacks, decoy documents dropped a Golang backdoor.
A Long-Running Actor Meets a Domestic Crackdown
The arrests close a chapter in a campaign history stretching back almost ten years. The group’s longevity suggests that its operators adapted their tools over time, as shown by the range of malware families attributed to it, from older remote access trojans to newer ones.
Russian law enforcement actions against financially motivated cybercriminals are uncommon, which is why the case drew attention. Many Russian-speaking criminal groups target victims outside the Commonwealth of Independent States, a pattern that has often been described as a factor in how such groups operate. VasyGrek is different in that its documented victims sit in Russia, Belarus and Kazakhstan, which brings it within reach of domestic prosecutors. That observation is analysis rather than something the MVD stated, and the ministry has not explained why it moved against this group now.
What Remains Unknown After the Raids
The sources leave important questions open. The MVD did not name the three suspects in the material available, and the announcement does not say how many people belong to the group. Whether remaining operators exist, and whether the tooling listed by researchers remains in circulation, is unknown. Malware families such as PureLogs, WarZone RAT and PowerLoader circulate in the wider criminal market, so their appearance in a VasyGrek toolkit does not mean the arrests will remove them.
The disruption is real, since the infrastructure that supported the phishing and malware delivery has been taken down. But the available facts do not show whether the group’s activity has stopped. Defenders in the targeted sectors still have indicators from BI.ZONE, F6 and Kaspersky to use when checking for the group’s phishing domains, decoy documents and the Golang backdoor.
Defensive Lessons From the VasyGrek Case
The September 2025 case illustrates the scale of an individual loss: 660,000 rubles through a single phishing email posing as business correspondence. The group’s lures depended on routine finance and accounting work, so staff who process invoices and payments were the exposed group. Organizations in the affected countries can check mail for lookalike financial and accounting domains tied to the group and review whether remote-administration tools appear on systems where they should not.
