Russia detains three suspected members of VasyGrek (Fluffy Wolf), a phishing group active since 2016, in a rare domestic crackdown; Kaspersky counted 100+ attempted attacks this year
- Kaspersky (Jan to Sep 2026): more than 100 attempted attacks on organizations in Russia, Belarus and Kazakhstan, most often metallurgy, wholesale raw-materials suppliers and government agencies. Lures were phishing emails with links to archives posing as accounting documents; a decoy opened while a Golang backdoor was loaded into a legitimate process.
- Earlier tooling (BI.ZONE, spring 2026): PureRAT, PureLogs, the PowerLoader downloader and Pay2Key ransomware, delivered via RAR archives and GitHub-hosted payloads.
- Charges: theft (up to 10 years) and creating or distributing malware (up to 5 years).
Arrests of Russian-speaking cybercriminals inside Russia are uncommon; this group mainly targeted Russian and regional companies. It is unclear whether the arrests will end its operations.
Sources: Kaspersky press release: more than 100 VasyGrek attack attempts in 2026 (Russian) · The Record: Russia dismantles infrastructure of VasyGrek cybercrime group, detains three suspects · BI.ZONE: Fluffy Wolf tested new tools on Russian companies (Russian)