-
Russian police arrested three suspected members of the VasyGrek hacking group, also called Fluffy Wolf.
-
Officers seized computers and phones, and they shut down the systems the group used for its attacks.
-
Kaspersky counted more than 100 attack attempts by the group between January and September 2026.
Russian authorities have arrested three people they believe belong to a hacking group called VasyGrek. The group also goes by the name Fluffy Wolf. Police say it sent fake emails to trick Russian and foreign companies into giving up money.
The Russian Ministry of Internal Affairs (MVD) shared the news in an official statement. Officers also took apart the systems the group used to run its attacks. The MVD says the group hit both Russian and international companies.
Police search homes and offices of three suspects
Several teams worked together on this case. Officers from the MVD’s technical operations and cybercrime departments took part. Moscow police joined them. Experts from the security company Kaspersky also helped.
The ministry released its statement on November 2. It said investigators had found the suspected members of the group. Officers then searched their homes and offices. They took computers, communication devices, and other items that could serve as proof.
The ministry named one organizer and two associates. The alleged organizer is now under house arrest. The two associates must stay home. They also cannot travel without permission.
The ministry said police have opened several criminal cases. The charges cover theft, the creation and spread of harmful software, and illegal business registration. Police say the group’s websites, servers, and tools formed the setup that officers took apart. No court has found the suspects guilty. The ministry added that the investigation is still going on.
Fake accounting Email led to stolen company money
According to the MVD, VasyGrek focused on targeted phishing attacks. Phishing means sending fake messages that trick people into opening harmful files. The group aimed these attacks at businesses in Russia and other countries. The police statement names phishing as the group’s main way of breaking in.
Police say the members built a network of websites. These sites copied the look of money and accounting services. The group also rented virtual servers that sit in other countries. In addition, it bought tools for secret remote control of computers on dark web markets.
The ministry described one case from September 2025. It did not name the company that suffered the attack. A worker in the accounting department got an email that looked like normal mail from a business partner. The email carried a file that claimed to be a reconciliation report.
The worker opened the file. That action started a harmful program on the computer. The program gave the attackers access to the device. It also let them reach the company’s online banking system.
The MVD says the attackers then moved more than 660,000 rubles out of the company’s account. They sent the money to accounts under their control. Police say the group used remote access to carry out the theft.
Kaspersky tracks 100 attack attempts in three countries
The arrests came at the same time as new findings from Kaspersky. The company shared them in a press release. Kaspersky says it found more than 100 attack attempts by VasyGrek in 2026. These attempts happened between January and September. They hit organizations in Russia, Belarus, and Kazakhstan.
Kaspersky says the group went after metal companies most often. It also chose sellers of raw materials and factory goods. Government offices were another common target. The company also named health care, oil and gas, energy, finance, and farming as possible targets. Kaspersky described these as possible targets, not confirmed victims. The group still sent its fake emails to a wide mix of industries.
Cyber threats are not limited to businesses or Windows-based systems. Individual users face similar risks across different platforms. A recent survey also found that Mac users face more cyber threats than Windows users, challenging the common belief that Apple’s computers are safer from cyberattacks.
Kaspersky explained one trick in detail. Attackers sent links to zipped folders that looked like accounting papers. Each folder held a harmful setup file. The file opened a fake document, so the victim saw nothing strange. Meanwhile, it quietly installed a hidden entry tool written in the Go programming language. That tool let the attackers run commands from far away on the infected device.
The company also noted that the group grew beyond Russia. Belarus and Kazakhstan now appear on its list of possible victims. Kaspersky saw attacks that worked in several steps. Each step loads the next piece of harmful code onto the device. The group also used trusted online services to store its harmful files. That choice made the attacks harder to spot and to study. Security teams had a tougher time tracing where the files came from.
Reports say researchers have followed this group for years. The arrests are a big blow to its work. Still, shutting down known systems does not prove that every part of the group has stopped. The MVD says its investigators are still working. Kaspersky’s findings show that fake emails remain a danger for companies in many fields. Kaspersky based these findings on its own tracking of the group’s activity in 2026.
