---
title: Russia detains three suspected members of VasyGrek (Fluffy Wolf), a phishing group active since 2016, in a rare domestic crackdown; Kaspersky counted 100+ attempted attacks this year | ctxsec
url: https://ctxsec.com/items/russia-mvd-vasygrek-fluffy-wolf-three-detained-kaspersky-100-attacks
description: "Russia's Interior Ministry said on Nov 2 that police dismantled VasyGrek's infrastructure and identified its members with help from Kaspersky. The alleged leader is under house arrest and two suspected accomplices are under travel restrictions. The ministry described the group's phishing sites posing as financial and accounting services, servers abroad and remote-access tools bought on dark-web markets, and one September 2025 case in which a booby-trapped 'financial document' led to the theft of more than 660,000 rubles from a company's online banking."
status: "official (Russian Interior Ministry statement as reported by The Record; Kaspersky press release, Nov 2)"
published: 2026-11-03
---

> Russia's Interior Ministry said on Nov 2 that police dismantled VasyGrek's infrastructure and identified its members with help from Kaspersky. The alleged leader is under house arrest and two suspected accomplices are under travel restrictions. The ministry described the group's phishing sites posing as financial and accounting services, servers abroad and remote-access tools bought on dark-web markets, and one September 2025 case in which a booby-trapped 'financial document' led to the theft of more than 660,000 rubles from a company's online banking.

[← Cybersecurity News](/news) · [markdown](/items/russia-mvd-vasygrek-fluffy-wolf-three-detained-kaspersky-100-attacks.md)

official (Russian Interior Ministry statement as reported by The Record; Kaspersky press release, Nov 2)

2026-11-03

### Russia detains three suspected members of VasyGrek (Fluffy Wolf), a phishing group active since 2016, in a rare domestic crackdown; Kaspersky counted 100+ attempted attacks this year

- **Kaspersky (Jan to Sep 2026):** more than 100 attempted attacks on organizations in Russia, Belarus and Kazakhstan, most often metallurgy, wholesale raw-materials suppliers and government agencies. Lures were phishing emails with links to archives posing as accounting documents; a decoy opened while a Golang backdoor was loaded into a legitimate process.
- **Earlier tooling (BI.ZONE, spring 2026):** PureRAT, PureLogs, the PowerLoader downloader and Pay2Key ransomware, delivered via RAR archives and GitHub-hosted payloads.
- **Charges:** theft (up to 10 years) and creating or distributing malware (up to 5 years).

Arrests of Russian-speaking cybercriminals inside Russia are uncommon; this group mainly targeted Russian and regional companies. It is unclear whether the arrests will end its operations.

Sources: [Kaspersky press release: more than 100 VasyGrek attack attempts in 2026 (Russian)](https://www.kaspersky.ru/about/press-releases/laboratoriya-kasperskogo-zafiksirovala-bolee-100-popytok-atak-gruppy-vasygrek-na-organizacii-v-rossii-i-stranah-sng-v-2026-godu) · [The Record: Russia dismantles infrastructure of VasyGrek cybercrime group, detains three suspects](https://therecord.media/russia-dismantles-vasygrek-infrastructure-detains-three) · [BI.ZONE: Fluffy Wolf tested new tools on Russian companies (Russian)](https://bi.zone/expertise/blog/fluffy-wolf-ispytal-novinki-na-rossiyskikh-kompaniyakh/)