THE CRUNCH
Russian authorities have arrested three suspected members of VasyGrek, a Russian-speaking cybercrime group also known as Fluffy Wolf that has been active since at least 2016. The Interior Ministry said on Monday that police had dismantled the group's infrastructure and identified its suspects following an investigation assisted by cybersecurity firm Kaspersky. The group primarily targeted Russian companies with phishing emails designed to steal credentials, reach corporate networks and deploy malware.
Ministry spokesperson Irina Volk said the alleged leader has been placed under house arrest, while two suspected accomplices were released under travel restrictions. The suspects face theft and malware charges carrying maximum sentences of 10 and five years respectively. Police searched homes and offices, seizing computers and communications equipment.
The group relied on an extensive network of phishing sites impersonating financial and accounting services, plus servers hosted abroad, and bought remote administration tools on dark web marketplaces for covert access to victims' computers. In one attack described by investigators, an accounting employee opened a malicious attachment in September 2025 that appeared to come from a business partner, giving the hackers remote access to the company's online banking system, from which more than 660,000 rubles, about $8,000, was transferred.
Such arrests are unusual in Russia, where many well-known Russian-speaking hacking groups have operated for years despite close monitoring by researchers and law enforcement. Volk said the group's activities had drawn attention from agencies in Russia, the United States and Europe, though she did not say whether foreign authorities assisted. The crackdown came as Kaspersky, in research published Monday, said it had detected more than 100 attempted attacks attributed to the group between January and September 2026, targeting organisations in Russia, Belarus and Kazakhstan, most often metallurgical firms, wholesale suppliers and government agencies. The ministry said the infrastructure had been dismantled, but it remains unclear whether the arrests will permanently end the group's operations.