Russia’s police arrest three suspected VasyGrek members

Russian police arrested three suspected members of VasyGrek and dismantled the group’s criminal infrastructure, the Interior Ministry said. Searches of the suspects' homes and offices also yielded computer equipment, communication devices and other potential evidence, The Hacker News reported.

The ministry said group members are suspected of stealing funds from organizations' accounts and creating, distributing and using malicious software. VasyGrek, also known as Fluffy Wolf, has targeted Russian and international companies since 2016. Cybersecurity company BI.ZONE and F6 assess the group as financially motivated.

A document used to deliver malicious software

In a September 2025 case, the ministry said, an email posed as business correspondence and asked an unnamed organization’s staff to open an accounting reconciliation report. Opening it triggered malicious software, and 660,000 rubles (about $8,100) was transferred from the organization’s bank account to accounts controlled by the attackers.

The ministry said the attacks used websites impersonating financial and accounting services, as well as virtual servers abroad. It said tools for secretly controlling computers remotely were acquired from the dark web. BI.ZONE and F6 said the group gained initial access through deceptive emails with attachments disguised as financial documents.

Attempts across three countries

Kaspersky said it recorded more than 100 attempted VasyGrek attacks against organizations in Russia, Belarus and Kazakhstan between January and September 2026. The figure counts attempts, not organizations successfully compromised.

The targets were primarily metallurgy businesses, wholesale suppliers of raw materials and industrial supplies, and government agencies. Kaspersky said the group’s potential targets had expanded to Belarus and Kazakhstan after previously focusing mainly on Russian organizations.