Russia’s Interior Ministry says it has dismantled the infrastructure of a financially motivated hacking group known as VasyGrek, also tracked as Fluffy Wolf, and detained three suspected members in an unusually public crackdown on a Russian-speaking cybercrime operation.

The group has been active since at least 2016, primarily targeting Russian companies through phishing emails designed to steal credentials, gain access to corporate networks and deploy remote access malware. The investigation was conducted with assistance from cybersecurity firm Kaspersky.

According to ministry spokesperson Irina Volk, the group’s alleged leader has been placed under house arrest while two suspected accomplices were released under travel restrictions. Volk said the group’s activities had drawn attention from law enforcement in Russia, the United States and Europe, though she did not specify whether foreign agencies assisted the investigation.

How the attacks worked

Investigators said the hackers built an extensive network of phishing sites impersonating financial and accounting services, backed by servers hosted abroad. They also purchased remote administration tools on dark web marketplaces to maintain covert access to victim machines.

In one case detailed by authorities, an employee in a company’s accounting department received an email in September 2025 appearing to come from a business partner, carrying a malicious attachment disguised as a routine financial document. Opening the file allegedly gave the hackers remote access to the employee’s computer and the company’s online banking system, allowing them to transfer more than 660,000 rubles (about $8,000) to accounts under their control.

Police searched the suspects’ homes and offices, seizing computers and communications equipment as evidence.

Expanding beyond Russia

The crackdown came as VasyGrek appeared to be broadening its targeting. In research published the same day, Kaspersky said it detected more than 100 attempted attacks attributed to the group between January and September 2026, hitting organizations in Russia, Belarus and Kazakhstan.

Kaspersky said the group most frequently targeted:

  • Metallurgical companies
  • Wholesale suppliers of raw materials and industrial goods
  • Government agencies

Other sectors hit included healthcare, oil and gas, energy, finance and agriculture.

The suspects face charges related to theft and the creation or distribution of malicious software, carrying potential sentences of up to 10 years and five years respectively. Such arrests remain rare in Russia, where many well-known hacking groups have continued operating for years despite close monitoring. The Interior Ministry said the group’s infrastructure has been dismantled, though it remains unclear whether the arrests will permanently end its operations.