Russian Police Arrest Three Suspects Linked to Long-Running VasyGrek Phishing Group

Russian authorities have arrested three suspected members of VasyGrek, also known as Fluffy Wolf, a cybercriminal group active since at least 2016. Russia's Interior Ministry said police dismantled the group's infrastructure and identified its members after an investigation assisted by cybersecurity firm Kaspersky. The alleged leader is under house arrest, while two suspected accomplices have been released under travel restrictions. Such arrests are unusual in Russia, where many Russian-speaking hacking groups have operated for years.

The group mainly targeted Russian companies with phishing emails designed to steal credentials, gain access to corporate networks and deploy malware. Authorities said it used a large network of phishing websites impersonating financial and accounting services, along with servers hosted abroad. It also bought remote administration tools on dark web marketplaces to gain covert access to victims' computers.

Investigators described one attack from September 2025. An accounting employee received an email that appeared to come from a business partner, with a malicious attachment disguised as a routine financial document. After the file was opened, the hackers allegedly gained remote access to the computer and the company's online banking system, then transferred more than 660,000 rubles (about $8,000) to accounts they controlled. The crackdown came as VasyGrek appeared to be expanding beyond Russia.