Russian MVD Arrests 3 Suspected VasyGrek (Fluffy Wolf) Members; Financially Motivated Phishing/Golang Backdoor Campaigns Continue to be Tracked

Key facts for VasyGrek Fluffy Wolf phishing

Detection coverage for VasyGrek Fluffy Wolf phishing

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5225 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: VasyGrek Accounting-Lure VBS/BAT Script Executed From Archive or Download Path

Detects wscript.exe, cscript.exe or cmd.exe running a .vbs/.bat file from a user Temp or Downloads path, where the command line carries a VasyGrek reconciliation-act lure name (e.g. akt_sverki_PDF.vbs, 1c-buh-akt) or the parent is an archiver, Explorer or Outlook. Since November 2025 VasyGrek (Fluffy Wolf) phishing archives deliver scripts that start the PureHVNC/RegAsm.exe chain; a script masquerading with a _PDF name is a strong user-execution signal.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566.001, T1204.002, T1059.005, T1059.003, T1036
• Data sources: sysmon, windows_security
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image=*\wscript.exe OR Image=*\cscript.exe OR Image=*\cmd.exe) (CommandLine=*.vbs* OR CommandLine=*.bat*) (CommandLine=*\AppData\Local\Temp\* OR CommandLine=*\Downloads\*) | eval lure=if(match(lower(CommandLine),"sverki|akt_sverki|1c-buh-akt|_pdf[.](vbs|bat)"),1,0) | where lure=1 OR match(lower(ParentImage),"(winrar|7zfm|7zg|explorer|outlook)[.]exe$") | stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentImage) as parents by host User | convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents | where Timestamp > ago(24h) | where FileName in~ ('wscript.exe','cscript.exe','cmd.exe') | where ProcessCommandLine has_any ('.vbs','.bat') | where ProcessCommandLine has_any ('\AppData\Local\Temp\','\Downloads\') | extend Lure = ProcessCommandLine matches regex @'(?i)sverki|akt_sverki|1c-buh-akt|_pdf\.(vbs|bat)' | where Lure or InitiatingProcessFileName in~ ('winrar.exe','7zfm.exe','7zg.exe','explorer.exe','outlook.exe') | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, Lure

Sigma

title: VasyGrek Accounting-Lure VBS/BAT Script Executed From Archive or Download Path
id: 5b1f6c2e-3a47-4d0b-9c81-7e2a40d1a501
status: experimental
description: Detects script hosts running a VBS/BAT file from a user Temp or Downloads path with VasyGrek (Fluffy Wolf) reconciliation-act lure names or launched from an archiver, Explorer or Outlook.
references:
    - https://www.anti-malware.ru/news/2025-11-25-111332/48180
    - https://thehackernews.com/2026/11/russian-police-arrest-3-suspected.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/04
tags:
    - attack.execution
    - attack.t1059.005
    - attack.t1204.002
    - attack.defense-evasion
    - attack.t1036
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
            - '\cmd.exe'
    selection_ext:
        CommandLine|contains:
            - '.vbs'
            - '.bat'
    selection_path:
        CommandLine|contains:
            - '\AppData\Local\Temp\'
            - '\Downloads\'
    selection_lure:
        CommandLine|contains:
            - 'sverki'
            - 'akt_sverki'
            - '1c-buh-akt'
            - '_PDF.vbs'
            - '_PDF.bat'
    selection_parent:
        ParentImage|endswith:
            - '\winrar.exe'
            - '\7zFM.exe'
            - '\7zG.exe'
            - '\explorer.exe'
            - '\OUTLOOK.EXE'
    condition: selection_img and selection_ext and selection_path and (selection_lure or selection_parent)
falsepositives:
    - Administrators running legitimate logon or maintenance scripts from Downloads
    - Accounting staff using internal 1C automation scripts with similar names
level: high

Known false positives:

• Administrators running legitimate logon or maintenance .bat/.vbs scripts from Downloads or Temp
• Accounting staff using internal 1C automation scripts whose names contain 'sverki' or 'akt'

Tuning notes: Add known internal automation script names and signed-script paths to an allowlist lookup. Extend the lure regex with new pretexts (payment orders, invoices) as they appear. Raise severity when the same host later shows RegAsm.exe spawned by the script host (see SPL-002).

• 🔒 VasyGrek Reconciliation-Act Phishing Email With Archive/Script Attachment or Lure Link · unlock with TL Creds
• 🔒 PowerShell Steganography Downloader Fetching Image With Embedded BASE64 Assembly · unlock with TL Creds
• 🔒 Script Host (wscript/cscript) Making Outbound Connection to Public Internet · unlock with TL Creds
• 🔒 Batch Script Launching Hidden or Encoded PowerShell From Download Path · unlock with TL Creds
• 🔒 RegAsm.exe Outbound Network Connection (Injected PureHVNC RAT C2) · unlock with TL Creds
• 🔒 XMRig Cryptominer Execution (VasyGrek Resource Hijacking) · unlock with TL Creds
• 🔒 RegAsm.exe Spawned by Script Host or PowerShell (PureHVNC Injection Target) · unlock with TL Creds
• 🔒 VasyGrek C2 Infrastructure Contact ([indicator], [indicator], [indicator]) · unlock with TL Creds

Indicators of compromise for VasyGrek Fluffy Wolf phishing

As of 2026-11-04, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-5225.

Sample indicators (3 of 16)

• IP address: 195.26.227[.]209
• Domain: 1c-buh-akt[.]ru
• IP address: 195.26.225[.]113

Defanged, TLP:CLEAR. Full set of 16 indicators: unlock with TL Creds.

How VasyGrek Fluffy Wolf phishing works

VasyGrek (also tracked as Fluffy Wolf by BI.ZONE) is a financially motivated cybercriminal group that has targeted Russian organizations since at least 2016. F.A.C.C.T. (formerly Group-IB Russia) has tracked the activity since 2020 and linked the group to the developer of the BurnsRAT / Mr.Burns tooling. On 2026-11-04 The Hacker News reported that the Russian MVD arrested three suspected members, who are suspected of embezzling funds from organizations' accounts and of creating, distributing and using malicious software, and dismantled part of the group's infrastructure.

Initial access is mass phishing that impersonates accounting departments with financial pretexts such as reconciliation acts (akty sverki), payment orders, unpaid invoices and '1C' themes. Sender and delivery domains are .ru and .su domains impersonating legitimate organizations or financial/accounting sites (e.g. 1c-buh-akt.ru). Victims receive archive attachments, or links to files hosted on GitHub or on actor-registered domains. Until roughly November 2025 the archives typically contained PureCrypter executables; since November 2025, F6 reports archives holding BAT and VBS scripts (e.g. akt_sverki_PDF.vbs) instead.

The documented November 2025 chain is: VBS script -> download of an image from a cloud/legitimate hosting service -> embedded BASE64 payload -> PowerShell steganography downloader / .NET assembly decode -> injection into RegAsm.exe -> PureHVNC execution with configured C2 parameters. F6 notes the same stego downloader was seen in Sticky Werewolf activity. Final payloads and tooling have included PureCrypter, PureLogs Stealer, PureHVNC/PureRAT, MetaStealer, WarZone RAT (Ave Maria), RedLine Stealer, XMRig, BurnsRAT, Pay2Key (RaaS ransomware, Mimic derivative), PowerLoader, LxBase RAT, CoreRAT, NightStrike RAT and a Golang backdoor. The group moved from Mr.Burns tooling to utilities from the 'PureCoder' author after public disclosure in 2024. F6 reported historical C2 at 195.26.227.209 and a migration to 195.26.225.113 in October 2025.

Victimology spans metallurgy, raw-material wholesale, industrial suppliers, manufacturing, construction, government, healthcare, oil/gas, energy, finance, IT, media, retail and agriculture. Per the source, a September 2025 incident (reconciliation-report phish) led to the theft of 660,000 RUB (about $8,000) from an organization's bank account. Geographic scope reportedly expanded in 2026 to Belarus and Kazakhstan. Infrastructure includes phishing domains imitating financial/accounting sites, foreign virtual servers, remote administration tools bought on dark-web markets and legitimate online services hosting malware components.

Caveats: the Kaspersky 2026 primary report was not retrievable; its figures (100+ attempted attacks, Jan-Sep 2026) and the Golang backdoor are taken from The Hacker News summary. Several domains named by F6 were reported without TLDs and are therefore not recorded as IOCs. BeaconBeagle lookups for the two C2 IPs returned HTTP 502 and could not be completed.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027.003 Steganography; T1036 Masquerading; T1055 Process Injection; T1218.009 Regsvcs/Regasm

Execution

T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.005 Visual Basic; T1204.002 Malicious File

Command and Control

T1219 Remote Access Tools

Impact

T1496 Resource Hijacking; T1657 Financial Theft

Credential Access

T1555 Credentials from Password Stores

Initial Access

T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link

Resource Development

T1583.001 Domains; T1583.003 Virtual Private Server; T1588.001 Malware

Remediation for VasyGrek Fluffy Wolf phishing

Immediate actions

• Block 195.26.227.209, 195.26.225.113 and 1c-buh-akt.ru at the perimeter and hunt for historical connections
• Quarantine inbound archives containing .vbs, .bat or PureCrypter-style executables with accounting/reconciliation lure names
• Alert on RegAsm.exe spawned by wscript.exe/cscript.exe/powershell.exe or making outbound network connections

Workarounds

• Restrict outbound access to code/image hosting services from non-developer endpoints where feasible
• Disable Windows Script Host for standard users

Longer-term hardening

• Train accounting and finance staff to verify reconciliation acts and payment orders out-of-band
• Block or script-restrict VBS/BAT/WSH execution from user-writable and mail-download paths
• Deploy EDR with behavioral detection for loader-to-RAT chains and process injection
• Require out-of-band confirmation and dual approval for bank payment changes

Affected and fixed versions

• Various — Windows endpoints and email users in Russian, Belarusian and Kazakh organizations

Timeline of VasyGrek Fluffy Wolf phishing

• 2016-01-01 VasyGrek begins operating against Russian organizations (year-level date; forum activity linked to infrastructure since 2016).
• 2020-01-01 F.A.C.C.T. specialists begin tracking the VasyGrek activity (year-level date).
• 2024-03-01 BI.ZONE publicly describes the cluster as 'Fluffy Wolf' (month-level date).
• 2024-07-01 Public disclosure of VasyGrek / Mr.Burns links; the group later discontinues locked-ioc-13 and moves to PureCoder tooling (month-level date).
• 2025-09-01 Reconciliation-report phishing email leads to theft of 660,000 RUB (~$8,000) from an organization's bank account (month-level date).
• 2025-10-01 F6 observes C2 migration from locked-ioc-6 to locked-ioc-7 (month-level date).
• 2025-11-01 Campaign shifts from archives with EXE files to archives with VBS/BAT scripts delivering locked-ioc-12 via RegAsm.exe injection (month-level date).
• 2025-11-25 Anti-Malware.ru publishes F6 findings on VasyGrek's August-November 2025 campaign and tooling change.
• 2026-01-01 Start of the January-September 2026 window in which Kaspersky reportedly documented 100+ attempted attacks in Russia, Belarus and Kazakhstan (month-level date).
• 2026-11-04 Russian MVD arrests three suspected VasyGrek members and dismantles part of the criminal infrastructure; reported by The Hacker News.

Sources cited for VasyGrek Fluffy Wolf phishing

• VasyGrek and Mr.Burns campaign analysis (F.A.C.C.T. on Habr) habr.com · Research
• Russian Police Arrest 3 Suspected VasyGrek Hackers, Dismantle Criminal Infrastructure The Hacker News · News · 2026-11-04
• Fluffy Wolf and reconciliation acts: how VasyGrek targets Russian accountants in 2025 (SecurityLab) securitylab.ru · News
• VasyGrek intensified phishing against Russian organizations, changing tools (Anti-Malware.ru, citing F6) anti-malware.ru · News · 2025-11-25
• Accounting as bait: new details of VasyGrek attacks on Russian companies (SecurityLab) securitylab.ru · News

More in threat intel

• Rehub: Russian-Language Cybercrime Forum Emerging as Primary Ransomware Marketplace (Post-XSS/RAMP Takedowns)
• Vercel deploys Device Bound Session Credentials (DBSC) against infostealer session cookie theft
• NCSC Annual Review 2026: AI-enabled malware and exploitation of legacy technology expected to target UK critical national infrastructure by 2028
• Industrialized Cybercrime Economy: Commoditized Stealer Logs, Phishing Kits, Identity Fraud and Ransomware Services (Group-IB)
• ShinyHunters Post-Arrest Brand Fight: Rival Factions, Shared Extortion Infrastructure and Impersonation (SLSH / Aegis / ShinyEquationCartel)