VasyGrek / Fluffy Wolf: Russian police arrest 3 suspected hackers and dismantle phishing infrastructure
Severity: medium · Patch status: no-fix-needed · Since 2026-11-04
Russian MVD arrested three suspected members of the VasyGrek (Fluffy Wolf) threat group and seized computer equipment and communication devices, dismantling its criminal infrastructure. Active since 2016, the group targeted Russian and international companies via phishing emails disguised as financial documents, using off-the-shelf stealers and RATs (MetaStealer, PureCrypter, PureLogs, WarZone RAT, BurnsRAT, PureRAT, PowerLoader) and legitimate remote-access software. Kaspersky recorded 100+ attempted attacks between January and September 2026 against organizations in Russia, Belarus and Kazakhstan, notably metallurgy, wholesale suppliers, government, healthcare, oil and gas, energy, finance and agriculture, using decoy documents to drop a Golang backdoor. A cited September 2025 incident resulted in 660,000 rubles (~$8,000) stolen from a bank account. No vendor fix applies; defenders should harden email and remote-access controls.
What to do
- Train finance and accounting staff to scrutinize emails and attachments posing as reconciliation reports or financial documents
- Enforce email filtering and attachment sandboxing for document-borne malware
- Restrict and monitor legitimate remote-access tools (Remote Utilities, NetSupport) and known RAT families
- Monitor for Golang backdoor behavior and multi-stage loaders hosted on legitimate online services
- Review banking transaction controls and out-of-band verification for payment instructions
Sources
All live incidents on Threat Watch
