Russian Authorities Dismantle VasyGrek Cybercrime Group, Detain Suspects
Russian law enforcement, with assistance from Kaspersky, has dismantled the infrastructure of the VasyGrek cybercrime group and detained three individuals.
Russian authorities have announced the arrest of three suspected members of the VasyGrek cybercrime group, a rare public move against a long-standing Russian-speaking hacking operation. The group, also known as Fluffy Wolf, has been active since at least 2016, primarily targeting Russian companies with sophisticated phishing campaigns aimed at stealing credentials, gaining network access, and deploying malware.
The investigation, conducted with support from cybersecurity firm Kaspersky, led to the dismantling of the group's operational infrastructure and the identification of its alleged members. According to the Russian Interior Ministry, the group's alleged leader has been placed under house arrest, while two accomplices face travel restrictions. Such public crackdowns are unusual in Russia, where many Russian-speaking hacking groups have historically operated with relative impunity.
VasyGrek's modus operandi involved an extensive network of phishing websites designed to impersonate financial and accounting services. They also utilized servers hosted abroad and purchased remote administration tools from dark web marketplaces to gain covert access to victim systems. One documented attack involved an accounting employee receiving a phishing email disguised as a financial document, which, upon opening, granted hackers remote access to the company's online banking system and resulted in the theft of over 660,000 rubles (approximately $8,000).
Kaspersky's research, published concurrently with the announcement, indicated that VasyGrek had expanded its operations beyond Russia, detecting over 100 attempted attacks between January and September 2026 targeting organizations in Russia, Belarus, and Kazakhstan. The primary targets included metallurgical companies, wholesale suppliers, government agencies, and sectors such as healthcare, oil and gas, finance, and agriculture.
The group's activities attracted the attention of law enforcement agencies in Russia, the United States, and Europe, though the extent of foreign involvement in the investigation was not detailed. Authorities searched the suspects' homes and offices, seizing computers, communication equipment, and other evidence pertinent to the investigation.
The detained suspects face charges related to theft and the creation or distribution of malicious software. Convictions could result in prison sentences of up to 10 years for theft and up to five years for malware-related offenses. While the group's hacking infrastructure has reportedly been dismantled, it remains uncertain whether these arrests will permanently halt their operations.
This operation highlights the ongoing efforts by Russian authorities to combat domestic cybercrime, even as many international observers have noted the persistent activity of Russian-speaking threat actors. The VasyGrek case underscores the financial motivations behind many cybercriminal groups and their reliance on common tactics like phishing and remote access trojans to achieve their objectives.