Russian authorities have arrested three suspected members of a threat group known as VasyGrek and dismantled its criminal infrastructure.

Also known as Fluffy Wolf, the threat actor has a history of targeting Russian and international companies since 2016.

The Ministry of Internal Affairs of the Russian Federation (MVD) said members of the group are "suspected of embezzling funds from the accounts of organizations, as well as creating, distributing, and using malicious software."

In one September 2025 case highlighted by the ministry, the attackers are said to have sent a phishing email to an unnamed organization, masquerading it as business correspondence and instructing recipients to open a reconciliation report that triggered the execution of malware.

The incident resulted in losses of 660,000 rubles ($8,000) from the organization's bank account, with the attackers transferring the funds to accounts under their control.

"The attacks utilized a vast network of phishing domains imitating financial and accounting service websites, as well as virtual servers located in foreign countries," MVD said. "Tools for covert remote administration were acquired from the dark web."

The rare law enforcement action saw Russian authorities conducting searches at the suspects' residences and the office premises they used to conduct the operations. It also led to the seizure of computer equipment, communication devices, and other items of evidentiary value.

ZONE and F6, VasyGrek is assessed to be a financially motivated threat actor that gains initial access by sending phishing emails with attachments disguised as financial documents.

Source link