Ethical Hacking News
Russian Police Arrest 3 Suspected VasyGrek Hackers, Dismantle Criminal Infrastructure. In a significant victory for law enforcement, Russian authorities have arrested three suspected members of the VasyGrek threat group, dismantling their criminal infrastructure and seizing computer equipment and other items of evidentiary value. The operation, which involved the arrest of three suspects, resulted in the disruption of the group's financial schemes and the rendering of their malicious software unusable. The arrest marks a significant blow to the group's operations and highlights the importance of law enforcement cooperation and collaboration in combating cybercrime and financial fraud.
The VasyGrek threat group has been dismantled by Russian authorities, marking a significant victory in combating cybercrime and financial fraud.The group was active since 2016, targeting Russian and international companies with a history of embezzling funds and creating malicious software.The group's modus operandi involved sending phishing emails to unsuspecting recipients, resulting in losses of $8,000 from one organization's bank account.The operation led to the seizure of computer equipment, communication devices, and other items of evidentiary value.The VasyGrek group was assessed to be a financially motivated threat actor using off-the-shelf stealers and trojans.The attacks primarily targeted entities in the metallurgical sector, along with wholesale suppliers of raw materials and industrial supplies, and government agencies.The dismantling of the VasyGrek group highlights the importance of law enforcement cooperation and collaboration in combating cybercrime and financial fraud.
The VasyGrek, also known as Fluffy Wolf, threat group, has been dismantled by Russian authorities, marking a significant victory in the ongoing quest to combat cybercrime and financial fraud in the country. The operation, which involved the arrest of three suspected members of the group, resulted in the dismantling of the criminal infrastructure and the seizure of computer equipment, communication devices, and other items of evidentiary value.
The VasyGrek threat group has been active since 2016, targeting Russian and international companies, with a history of embezzling funds from the accounts of organizations and creating, distributing, and using malicious software. The group's modus operandi has involved sending phishing emails to unsuspecting recipients, masquerading them as business correspondence, and instructing them to open a reconciliation report that triggered the execution of malware.
In one notable case, the attackers sent a phishing email to an unnamed organization, resulting in losses of 660,000 rubles ($8,000) from the organization's bank account. The attackers then transferred the funds to accounts under their control, using a vast network of phishing domains imitating financial and accounting service websites, as well as virtual servers located in foreign countries.
The Russian authorities, in collaboration with the Ministry of Internal Affairs of the Russian Federation (MVD), conducted searches at the suspects' residences and the office premises they used to conduct the operations. The operation also led to the seizure of computer equipment, communication devices, and other items of evidentiary value.
According to reports from Russian cybersecurity company BI.ZONE and F6, VasyGrek is assessed to be a financially motivated threat actor that gains initial access by sending phishing emails with attachments disguised as financial documents. The group's arsenal includes off-the-shelf stealers and trojans, such as MetaStealer, PureCrypter, PureLogs Stealer, WarZone RAT, XMRig, BurnsRAT, PureHVNC, PureRAT, Pay2Key, and PowerLoader, as well as legitimate remote access software such as Remote Utilities.
The attacks primarily targeted entities in the metallurgical sector, along with wholesale suppliers of raw materials and industrial supplies, and government agencies. Other targets included organizations in the healthcare, oil and gas, energy, finance, and agriculture sectors.
The development comes as BI.ZONE detected multiple attacks targeting Russian organizations using malware families like LxBase RAT, CoreRAT, and NightStrike RAT. While LxBase RAT, a commercial trojan that costs $119 per month, is distributed via mass phishing campaigns, CoreRAT infection chains make use of phishing emails containing 7zSFX and Rust droppers for delivery. The activity has been attributed to Core Werewolf, which is assessed to share some level of overlap with Vortex Werewolf.
Attacks deploying NightStrike RAT have been associated with a hacktivist-turned-cyber espionage cluster dubbed Insolent Werewolf. Initial access is achieved using ClickFix-style attacks to deploy NetSupport Manager to gain remote access. Insolent Werewolf also utilizes Octowave Loader to deploy AdaptixC2 and Havoc post-exploitation framework implants in compromised systems.
The rare law enforcement action saw Russian authorities conducting searches at the suspects' residences and the office premises they used to conduct the operations. The operation also led to the seizure of computer equipment, communication devices, and other items of evidentiary value.
In a report published this week, Kaspersky said it recorded over 100 attempted attacks orchestrated by VasyGrek against organizations in Russia, Belarus, and Kazakhstan between January and September 2026. These attacks have also been observed using decoy documents to drop a Golang backdoor capable of executing arbitrary commands on the infected device.
The attacks primarily singled out entities in the metallurgical sector, along with wholesale suppliers of raw materials and industrial supplies, and government agencies. Other targets included organizations in the healthcare, oil and gas, energy, finance, and agriculture sectors.
The development comes as BI.ZONE it detected multiple attacks targeting Russian organizations using malware families like LxBase RAT, CoreRAT, and NightStrike RAT.
The arrest of the suspected members of the VasyGrek threat group marks a significant blow to the group's operations, disrupting their financial schemes and rendering their malicious software unusable. The operation also highlights the importance of law enforcement cooperation and collaboration in combating cybercrime and financial fraud.
In conclusion, the dismantling of the VasyGrek threat group serves as a reminder of the ongoing threat of cybercrime and financial fraud, and the importance of vigilance and cooperation in combating these threats. The operation highlights the efforts of Russian authorities to disrupt the operations of malicious groups and protect the interests of organizations and individuals alike.
Related Information:
https://www.ethicalhackingnews.com/articles/Russian-Police-Dismantle-VasyGrek-Hackers-Operation-Seize-Computer-Equipment-and-Disrupt-Financial-Schemes-ehn.shtml
https://thehackernews.com/2026/11/russian-police-arrest-3-suspected.html
Published: Wed Nov 4 03:43:09 2026 by llama3.2 3B Q4_K_M
