cyber.hendryadrian.com
Security News · thehackernews.com

Russian Authorities Arrest Three Suspected VasyGrek Members and Dismantle Infrastructure

· Original article ↗

Summary

Russian authorities say they arrested three suspected VasyGrek (Fluffy Wolf) members and dismantled their infrastructure. Kaspersky reported 100+ attempted attacks on organizations in Russia, Belarus and Kazakhstan from January–September 2026.

Key points

  • The Russian Ministry of Internal Affairs said three suspects were arrested on suspicion of embezzlement and creating, distributing, and using malware; searches led to the seizure of computer and communication equipment.
  • In a case cited by the ministry, a September 2025 phishing email disguised as business correspondence led to malware execution and a reported loss of 660,000 rubles from an organization's bank account.
  • Kaspersky reported more than 100 attempted VasyGrek attacks against organizations in Russia, Belarus, and Kazakhstan between January and September 2026; decoy documents were used to deliver a Golang backdoor capable of executing commands.
  • Reported targets included metallurgical businesses, raw-material and industrial suppliers, government agencies, and organizations in healthcare, energy, finance, oil and gas, and agriculture.
  • BI.ZONE and F6 describe VasyGrek as financially motivated and report its use of phishing attachments disguised as financial documents and a range of stealers and remote-access trojans.
  • The article also describes separate activity attributed to Core Werewolf and Insolent Werewolf, including reported use of CoreRAT, NightStrike RAT, and remote-access tools.

Article Details

Event Type
Russian authorities arrested three people suspected of belonging to VasyGrek and dismantled the group's criminal infrastructure.
Impact
In a case highlighted by the Ministry of Internal Affairs of the Russian Federation, a September 2025 phishing attack reportedly caused an organization to lose 660,000 rubles ($8,000). Kaspersky reported more than 100 attempted VasyGrek attacks against organizations in Russia, Belarus, and Kazakhstan from January through September 2026. Authorities seized computer equipment and communication devices during searches.

MITRE ATT&CK

T1204.002 · Malicious FileA reported phishing email instructed recipients to open a disguised reconciliation report, triggering malware execution.T1219 · Remote Access ToolsIn attacks associated with Insolent Werewolf, NetSupport Manager was deployed to gain remote access.T1566.001 · Spearphishing AttachmentVasyGrek reportedly used phishing emails with attachments disguised as financial documents.

People

Nikita NazarovHead of advanced threat research at Kaspersky; he described VasyGrek's expanded targeting of organizations in Belarus and Kazakhstan.

Threat Actors

Core WerewolfActivity involving CoreRAT has been attributed to Core Werewolf.Fluffy WolfThe article identifies Fluffy Wolf as another name for VasyGrek, which it describes as a threat group targeting Russian and international companies since 2016.Insolent WerewolfA hacktivist-turned-cyber-espionage cluster associated with NightStrike RAT attacks and the deployment of remote-access and post-exploitation tools.VasyGrekRussian authorities arrested three people suspected of belonging to the group. Reports describe it as financially motivated and attribute phishing and malware attacks against organizations to it.Vortex WerewolfThe article assesses that Core Werewolf shares some level of overlap with Vortex Werewolf; it does not independently attribute the CoreRAT activity to Vortex Werewolf.

Malware

BurnsRAToff-the-shelf stealers and trojans, like MetaStealer, PureCrypter, PureLogs Stealer, WarZone RAT, XMRig, BurnsRAT, PureHVNC, PureRAT, Pay2Key, and PowerLoader, as well as legitimate remote access software such asCapDoorsystems," BI.ZONE said, adding the group's malware arsenal includes other remote access trojans like CapDoor and NightWire.CoreRATThe development comes as BI.ZONE it detected multiple attacks targeting Russian organizations using malware families like LxBase RAT, CoreRAT, and NightStrike RAT.LXBaseratThe development comes as BI.ZONE it detected multiple attacks targeting Russian organizations using malware families like LxBase RAT, CoreRAT, and NightStrike RAT.MetaStealerSome of the key tools in its arsenal include off-the-shelf stealers and trojans, like MetaStealer, PureCrypter, PureLogs Stealer, WarZone RAT, XMRig, BurnsRAT, PureHVNC, PureRAT, Pay2Key, and PowerLoader, as well asNightStrike RATThe development comes as BI.ZONE it detected multiple attacks targeting Russian organizations using malware families like LxBase RAT, CoreRAT, and NightStrike RAT.NightWireBI.ZONE said, adding the group's malware arsenal includes other remote access trojans like CapDoor and NightWire.Octowave Loader"Insolent Werewolf also utilizes Octowave Loader to deploy AdaptixC2 and Havoc post‑exploitation framework implants in compromised systems," BI.ZONE said, adding the group's malware arsenal includes other remote accessPay2Keylike MetaStealer, PureCrypter, PureLogs Stealer, WarZone RAT, XMRig, BurnsRAT, PureHVNC, PureRAT, Pay2Key, and PowerLoader, as well as legitimate remote access software such as Remote Utilities.PowerLoaderPureCrypter, PureLogs Stealer, WarZone RAT, XMRig, BurnsRAT, PureHVNC, PureRAT, Pay2Key, and PowerLoader, as well as legitimate remote access software such as Remote Utilities.PureCrypterSome of the key tools in its arsenal include off-the-shelf stealers and trojans, like MetaStealer, PureCrypter, PureLogs Stealer, WarZone RAT, XMRig, BurnsRAT, PureHVNC, PureRAT, Pay2Key, and PowerLoader, as well asPureHVNC RATstealers and trojans, like MetaStealer, PureCrypter, PureLogs Stealer, WarZone RAT, XMRig, BurnsRAT, PureHVNC, PureRAT, Pay2Key, and PowerLoader, as well as legitimate remote access software such as RemotePureLogs Stealerkey tools in its arsenal include off-the-shelf stealers and trojans, like MetaStealer, PureCrypter, PureLogs Stealer, WarZone RAT, XMRig, BurnsRAT, PureHVNC, PureRAT, Pay2Key, and PowerLoader, as well as legitimatePureRatand trojans, like MetaStealer, PureCrypter, PureLogs Stealer, WarZone RAT, XMRig, BurnsRAT, PureHVNC, PureRAT, Pay2Key, and PowerLoader, as well as legitimate remote access software such as Remote Utilities.Warzone RATarsenal include off-the-shelf stealers and trojans, like MetaStealer, PureCrypter, PureLogs Stealer, WarZone RAT, XMRig, BurnsRAT, PureHVNC, PureRAT, Pay2Key, and PowerLoader, as well as legitimate remote accessXMRiginclude off-the-shelf stealers and trojans, like MetaStealer, PureCrypter, PureLogs Stealer, WarZone RAT, XMRig, BurnsRAT, PureHVNC, PureRAT, Pay2Key, and PowerLoader, as well as legitimate remote access software such

Products

NetSupport Managercluster dubbed Insolent Werewolf. Initial access is achieved using ClickFix-style attacks to deploy NetSupport Manager to gain remote access.Remote UtilitiesPureHVNC, PureRAT, Pay2Key, and PowerLoader, as well as legitimate remote access software such as Remote Utilities.

Tools

AdaptixC2"Insolent Werewolf also utilizes Octowave Loader to deploy AdaptixC2 and Havoc post‑exploitation framework implants in compromised systems," BI.ZONE said, adding the group's malware arsenal includes other remote accessHavoc"Insolent Werewolf also utilizes Octowave Loader to deploy AdaptixC2 and Havoc post‑exploitation framework implants in compromised systems," BI.ZONE said, adding the group's malware arsenal includes other remote access

Countries

Belarussaid it recorded over 100 attempted attacks orchestrated by VasyGrek against organizations in Russia, Belarus, and Kazakhstan between January and September 2026. These attacks have also been observed using decoyKazakhstanover 100 attempted attacks orchestrated by VasyGrek against organizations in Russia, Belarus, and Kazakhstan between January and September 2026. These attacks have also been observed using decoy documents to dropRussiaKaspersky said it recorded over 100 attempted attacks orchestrated by VasyGrek against organizations in Russia, Belarus, and Kazakhstan between January and September 2026. These attacks have also been observed using

Industries

Agricultureagencies. Other targets included organizations in the healthcare, oil and gas, energy, finance, and agriculture sectors.Energysupplies and government agencies. Other targets included organizations in the healthcare, oil and gas, energy, finance, and agriculture sectors.financeand government agencies. Other targets included organizations in the healthcare, oil and gas, energy, finance, and agriculture sectors.Governmentthe metallurgical sector, along with wholesale suppliers of raw materials and industrial supplies and government agencies. Other targets included organizations in the healthcare, oil and gas, energy, finance, andHealthcarematerials and industrial supplies and government agencies. Other targets included organizations in the healthcare, oil and gas, energy, finance, and agriculture sectors.Oil and gasindustrial supplies and government agencies. Other targets included organizations in the healthcare, oil and gas, energy, finance, and agriculture sectors.Wholesale suppliers of raw materials and industrial suppliesattacks primarily singled out entities in the metallurgical sector, along with wholesale suppliers of raw materials and industrial supplies and government agencies. Other targets included organizations in the

Related Articles