Russian Police Arrest Three Suspected VasyGrek Members Behind Fake Invoice Phishing Attacks

Russian authorities have arrested three suspected members of VasyGrek, also known as Fluffy Wolf, and dismantled its criminal infrastructure. The group has reportedly targeted Russian and international companies since 2016. Russia's Ministry of Internal Affairs said the suspects are accused of embezzling funds from organisations' accounts and of creating, distributing and using malicious software. Police searched the suspects' homes and office premises and seized computer equipment, communication devices and other evidence.

In one September 2025 case, the attackers emailed an organisation a message made to look like business correspondence, asking recipients to open a reconciliation report. Opening it ran malware, and 660,000 rubles (about $8,000) was transferred from the organisation's bank account to accounts the attackers controlled. The ministry said the group used a large network of phishing domains imitating financial and accounting service websites, along with servers in foreign countries, and bought remote administration tools from the dark web.

Security firms BI.ZONE and F6 assess VasyGrek as financially motivated, gaining access through phishing emails with attachments disguised as financial documents. Its toolkit includes off-the-shelf stealers and remote access trojans, as well as legitimate remote access software such as Remote Utilities. Kaspersky reported more than 100 attempted attacks by the group against organisations in Russia, Belarus and Kazakhstan between January and September 2026, some using decoy documents to deliver a backdoor that can run arbitrary commands on an infected device.