Russia detains three suspected VasyGrek members and dismantles group's infrastructure

Russian police have detained three suspected members of a cybercrime group tracked as VasyGrek, also known as Fluffy Wolf, and dismantled its infrastructure. The Interior Ministry said Monday that the investigation was carried out with assistance from Kaspersky.

The alleged leader is under house arrest. Two suspected accomplices were released under travel restrictions, according to ministry spokesperson Irina Volk.

The group has been active since at least 2016 and has mostly gone after Russian companies, using phishing emails to steal credentials, get into corporate networks and deploy malware. Authorities say it ran a network of phishing sites impersonating financial and accounting services, used servers hosted abroad, and bought remote administration tools on dark web marketplaces.

In one case the ministry described, an accounting employee received an email in September 2025 that looked like it came from a business partner, with a malicious attachment posing as a financial document. Investigators say the hackers got remote access to the computer and the company's online banking system and moved more than 660,000 rubles ($8,000) to accounts they controlled.

Kaspersky, in research also published Monday, said it detected more than 100 attempted attacks attributed to the group between January and September 2026, aimed at organisations in Russia, Belarus and Kazakhstan. Metallurgical companies, wholesale suppliers of raw materials and industrial goods, and government agencies were hit most often.

The suspects face theft and malware charges, with up to 10 years on the theft charge and up to five years on the malware charge if convicted. Volk said the group's activity had drawn attention from law enforcement in Russia, the United States and Europe, but didn't say whether foreign authorities took part. The ministry says the infrastructure is gone; whether the group stops operating is another question.

For defenders, the pattern here is the old one: a plausible business email, an attachment that looks like a document, and remote access tools doing the rest. Mail filtering and rules on what accounting staff can open are worth more than most of the rest of it.