"suspected of embezzling funds from the accounts of organizations, as well as creating, distributing, and using malicious software," MVD said.
What Russian authorities say they disrupted
Russian law enforcement announced the arrest of three suspected members of a threat group known as VasyGrek—also tracked as Fluffy Wolf—and said it dismantled the group's criminal infrastructure. The Ministry of Internal Affairs of the Russian Federation (MVD) described the suspects as engaged in financial theft and the creation, distribution and use of malware. Authorities conducted searches at the suspects' residences and at the office premises the group used, seizing computer equipment, communication devices and other items the MVD called evidentiary.
The September 2025 phishing case and theft mechanics
The MVD highlighted one incident from September 2025 in which attackers sent a phishing email to an unnamed organization, posing as routine business correspondence and instructing recipients to open a "reconciliation report." Opening that document triggered malware execution, and the attackers then siphoned 660,000 rubles ($8,000) from the organization’s bank account to accounts under their control. The MVD said the attackers relied on a broad network of phishing domains that imitated financial and accounting service websites and on virtual servers located in foreign countries; "tools for covert remote administration were acquired from the dark web," the ministry added.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleVasyGrek’s tradecraft: phishing, decoys and legitimate services
Private-sector research cited by the MVD and published reporting assess VasyGrek as financially motivated and focused on initial access via phishing emails with attachments disguised as financial documents. Kaspersky reported that the group used decoy documents to drop a Golang backdoor capable of executing arbitrary commands on infected devices. Kaspersky also noted multi‑stage infection schemes that used legitimate online services to host malicious components—techniques that can conceal activity and complicate analysis, according to Nikita Nazarov, head of advanced threat research at Kaspersky.
Tools, trojans and associated clusters
Security vendors BI.ZONE and F6, and the MVD, catalogued a long list of off‑the‑shelf stealers, trojans and remote access tools observed in VasyGrek activity. These include MetaStealer, PureCrypter, PureLogs Stealer, WarZone RAT, XMRig, BurnsRAT, PureHVNC, PureRAT, Pay2Key, PowerLoader and the legitimate Remote Utilities product. Kaspersky added that decoy documents have been used to drop a Golang backdoor.
BI.ZONE reported related and overlapping activity involving other malware families and clusters. It detected attacks using LxBase RAT, a commercial trojan reportedly available for $119 per month, distributed via mass phishing campaigns; CoreRAT, delivered in chains that use 7zSFX and Rust droppers; and NightStrike RAT, a C++ remote access trojan BI.ZONE linked to the developer of NightWire on the basis of coding-style similarities.
BI.ZONE associated CoreRAT activity with a cluster called Core Werewolf, which it assesses shares overlap with Vortex Werewolf. Attacks that deploy NightStrike have been linked to an actor BI.ZONE calls Insolent Werewolf; those campaigns achieve initial access with ClickFix-style attacks that deploy NetSupport Manager and use Octowave Loader to stage implants such as AdaptixC2 and the Havoc post‑exploitation framework. BI.ZONE also listed other remote access implants in this space including CapDoor and NightWire.
How technologists, affected enterprises, and investigators are likely to respond
Technologists and security teams will need to examine detection telemetry for phishing domains imitating financial and accounting services, and for use of legitimate hosting services as staging points—both techniques specifically noted by Kaspersky and the MVD. They will also want to hunt for indicators tied to the named toolset, including the Golang backdoor behavior Kaspersky described.
Enterprises in the metallurgical sector, wholesale suppliers of raw materials and industrial supplies, government agencies, and other sectors Kaspersky said were targeted—healthcare, oil and gas, energy, finance and agriculture—should be alert to mass‑phishing patterns and decoy financial documents. Kaspersky recorded over 100 attempted VasyGrek attacks against organizations in Russia, Belarus and Kazakhstan from January through September 2026, underlining the geographic spread the vendor flagged this year.
Law enforcement and investigators will point to the MVD’s searches, seizures and arrests as an operational model for disrupting financially motivated threat clusters. The ministry’s account links forensic evidence—phishing domains, virtual servers located abroad and dark‑web procurement of remote administration tools—to criminal prosecution and asset seizure.
The public record in this episode ties a long list of commodity and custom malware to a financially motivated campaign, shows a shift in target geography beyond Russia into Belarus and Kazakhstan, and documents a rare, tangible law enforcement disruption that included arrests and seizures. Whether the disruption will materially reduce attempted thefts or prompt rapid migration of tooling and infrastructure remains the next question for defenders and investigators alike.
