● Covered by 2 sources · 2 reportsMedium impact2 neutral
Russia dismantles VasyGrek cybercrime group, detains three suspects
Key points
- Three VasyGrek cybercrime group members detained in Russia.
- Group active since 2016, targeted Russian companies with phishing.
- Infrastructure dismantled with assistance from Kaspersky.
- Alleged leader under house arrest, two accomplices restricted.
- VasyGrek is also known as Fluffy Wolf.
- The group targeted international companies.
- The Ministry of Internal Affairs of the Russian Federation (MVD) announced the arrests.
- One attack in September 2025 caused 660,000 rubles ($8,000) in losses.
Cybercrime Group Dismantled
Russian authorities announced the arrest of three suspected members of the VasyGrek cybercrime group, also known as Fluffy Wolf. The group's operational infrastructure has been dismantled following an investigation supported by cybersecurity firm Kaspersky. This action represents an unusual public crackdown on a Russian-speaking hacking operation within Russia.
Group's Activities and Targets
VasyGrek has been active since at least 2016, primarily focusing on Russian companies. Their method involved phishing emails designed to steal credentials, gain access to corporate networks, and deploy malware. The group utilized an extensive network of phishing websites impersonating financial and accounting services, along with servers hosted abroad. They also acquired remote administration tools from dark web marketplaces to access victims' computers covertly.
Investigation and Arrests
The Russian Interior Ministry confirmed the dismantling of the group's infrastructure and the identification of its members. The alleged leader of VasyGrek has been placed under house arrest, while two suspected accomplices are under travel restrictions. The group's activities had drawn the attention of law enforcement agencies in Russia, the United States, and Europe.
Example of an Attack
Investigators detailed an attack where an employee in an unnamed company's accounting department received a malicious email in September 2025. The email, disguised as a financial document from a business partner, allowed hackers remote access to the computer and the company's online banking system upon opening. Over 660,000 rubles ($8,000) were subsequently transferred to accounts controlled by the hackers.
Expanding Operations
The crackdown occurred as VasyGrek appeared to be expanding its operations beyond Russia. Kaspersky reported detecting over 100 attempted attacks attributed to the group between January and September 2026, indicating a broader scope of activity before the arrests.
Updates
- VasyGrek is also known as Fluffy Wolf.
- The group targeted international companies.
- The Ministry of Internal Affairs of the Russian Federation (MVD) announced the arrests.
- One attack in September 2025 caused 660,000 rubles ($8,000) in losses.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
How outlets covered it
Russian authorities arrested three suspected members of the VasyGrek hacking group and dismantled its criminal infrastructure. VasyGrek, also known as Fluffy Wolf, has targeted Russian and international companies since 2016, using phishing and various malware to embezzle funds. This action disrupts a financially motivated threat actor known for using off-the-shelf tools and custom backdoors.
Russian authorities arrested three suspected members of the VasyGrek cybercrime group and dismantled its infrastructure. The group, active since 2016, primarily targeted Russian companies with phishing attacks to steal credentials and deploy malware. This action marks a rare public crackdown on a Russian-speaking hacking operation within Russia.