# Russian MVD Arrests 3 Suspected VasyGrek (Fluffy Wolf) Members; Financially Motivated Phishing/Golang Backdoor Campaigns Continue to be Tracked

> Russia's Ministry of Internal Affairs (MVD) arrested three suspected members of VasyGrek (aka Fluffy Wolf), a financially motivated group active since 2016 that phishes organizations with accounting-themed lures to deliver commodity RATs, stealers and a Golang backdoor. Kaspersky reportedly documented 100+ attempted attacks against organizations in Russia, Belarus and Kazakhstan between January and September 2026; the arrests do not confirm cessation of activity.

- **Published:** 2026-11-04T09:35:41Z
- **Last reviewed:** 2026-11-04T09:35:41Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5225
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5225.png
- **ID:** TL-2026-5225
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** MONITORING
- **Actor:** VasyGrek
- **Detections:** 9 (1 shown free below) · **IOCs:** 16 (3 shown free below)

## Description

VasyGrek (also tracked as Fluffy Wolf by BI.ZONE) is a financially motivated cybercriminal group that has targeted Russian organizations since at least 2016. F.A.C.C.T. (formerly Group-IB Russia) has tracked the activity since 2020 and linked the group to the developer of the BurnsRAT / Mr.Burns tooling. On 2026-11-04 The Hacker News reported that the Russian MVD arrested three suspected members, who are suspected of embezzling funds from organizations' accounts and of creating, distributing and using malicious software, and dismantled part of the group's infrastructure.

Initial access is mass phishing that impersonates accounting departments with financial pretexts such as reconciliation acts (akty sverki), payment orders, unpaid invoices and '1C' themes. Sender and delivery domains are .ru and .su domains impersonating legitimate organizations or financial/accounting sites (e.g. 1c-buh-akt.ru). Victims receive archive attachments, or links to files hosted on GitHub or on actor-registered domains. Until roughly November 2025 the archives typically contained PureCrypter executables; since November 2025, F6 reports archives holding BAT and VBS scripts (e.g. akt_sverki_PDF.vbs) instead.

The documented November 2025 chain is: VBS script -> download of an image from a cloud/legitimate hosting service -> embedded BASE64 payload -> PowerShell steganography downloader / .NET assembly decode -> injection into RegAsm.exe -> PureHVNC execution with configured C2 parameters. F6 notes the same stego downloader was seen in Sticky Werewolf activity. Final payloads and tooling have included PureCrypter, PureLogs Stealer, PureHVNC/PureRAT, MetaStealer, WarZone RAT (Ave Maria), RedLine Stealer, XMRig, BurnsRAT, Pay2Key (RaaS ransomware, Mimic derivative), PowerLoader, LxBase RAT, CoreRAT, NightStrike RAT and a Golang backdoor. The group moved from Mr.Burns tooling to utilities from the 'PureCoder' author after public disclosure in 2024. F6 reported historical C2 at 195.26.227.209 and a migration to 195.26.225.113 in October 2025.

Victimology spans metallurgy, raw-material wholesale, industrial suppliers, manufacturing, construction, government, healthcare, oil/gas, energy, finance, IT, media, retail and agriculture. Per the source, a September 2025 incident (reconciliation-report phish) led to the theft of 660,000 RUB (about $8,000) from an organization's bank account. Geographic scope reportedly expanded in 2026 to Belarus and Kazakhstan. Infrastructure includes phishing domains imitating financial/accounting sites, foreign virtual servers, remote administration tools bought on dark-web markets and legitimate online services hosting malware components.

Caveats: the Kaspersky 2026 primary report was not retrievable; its figures (100+ attempted attacks, Jan-Sep 2026) and the Golang backdoor are taken from The Hacker News summary. Several domains named by F6 were reported without TLDs and are therefore not recorded as IOCs. BeaconBeagle lookups for the two C2 IPs returned HTTP 502 and could not be completed.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1059.005 Visual Basic
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1055 Process Injection
- T1027.003 Steganography
- T1218.009 Regsvcs/Regasm
- T1036 Masquerading
- T1219 Remote Access Tools
- T1583.001 Domains
- T1583.003 Virtual Private Server
- T1588.001 Malware
- T1555 Credentials from Password Stores
- T1496 Resource Hijacking
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**VasyGrek Accounting-Lure VBS/BAT Script Executed From Archive or Download Path** (`TL-2026-5225-SPL-001`)

Detects wscript.exe, cscript.exe or cmd.exe running a .vbs/.bat file from a user Temp or Downloads path, where the command line carries a VasyGrek reconciliation-act lure name (e.g. akt_sverki_PDF.vbs, 1c-buh-akt) or the parent is an archiver, Explorer or Outlook. Since November 2025 VasyGrek (Fluffy Wolf) phishing archives deliver scripts that start the PureHVNC/RegAsm.exe chain; a script masquerading with a _PDF name is a strong user-execution signal.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.001, T1204.002, T1059.005, T1059.003, T1036
- **Data sources:** sysmon, windows_security
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image=*\wscript.exe OR Image=*\cscript.exe OR Image=*\cmd.exe) (CommandLine=*.vbs* OR CommandLine=*.bat*) (CommandLine=*\AppData\Local\Temp\* OR CommandLine=*\Downloads\*) | eval lure=if(match(lower(CommandLine),"sverki|akt_sverki|1c-buh-akt|_pdf[.](vbs|bat)"),1,0) | where lure=1 OR match(lower(ParentImage),"(winrar|7zfm|7zg|explorer|outlook)[.]exe$") | stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentImage) as parents by host User | convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents | where Timestamp > ago(24h) | where FileName in~ ('wscript.exe','cscript.exe','cmd.exe') | where ProcessCommandLine has_any ('.vbs','.bat') | where ProcessCommandLine has_any ('\AppData\Local\Temp\','\Downloads\') | extend Lure = ProcessCommandLine matches regex @'(?i)sverki|akt_sverki|1c-buh-akt|_pdf\.(vbs|bat)' | where Lure or InitiatingProcessFileName in~ ('winrar.exe','7zfm.exe','7zg.exe','explorer.exe','outlook.exe') | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, Lure
```

### Sigma

```yaml
title: VasyGrek Accounting-Lure VBS/BAT Script Executed From Archive or Download Path
id: 5b1f6c2e-3a47-4d0b-9c81-7e2a40d1a501
status: experimental
description: Detects script hosts running a VBS/BAT file from a user Temp or Downloads path with VasyGrek (Fluffy Wolf) reconciliation-act lure names or launched from an archiver, Explorer or Outlook.
references:
    - https://www.anti-malware.ru/news/2025-11-25-111332/48180
    - https://thehackernews.com/2026/11/russian-police-arrest-3-suspected.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/04
tags:
    - attack.execution
    - attack.t1059.005
    - attack.t1204.002
    - attack.defense-evasion
    - attack.t1036
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
            - '\cmd.exe'
    selection_ext:
        CommandLine|contains:
            - '.vbs'
            - '.bat'
    selection_path:
        CommandLine|contains:
            - '\AppData\Local\Temp\'
            - '\Downloads\'
    selection_lure:
        CommandLine|contains:
            - 'sverki'
            - 'akt_sverki'
            - '1c-buh-akt'
            - '_PDF.vbs'
            - '_PDF.bat'
    selection_parent:
        ParentImage|endswith:
            - '\winrar.exe'
            - '\7zFM.exe'
            - '\7zG.exe'
            - '\explorer.exe'
            - '\OUTLOOK.EXE'
    condition: selection_img and selection_ext and selection_path and (selection_lure or selection_parent)
falsepositives:
    - Administrators running legitimate logon or maintenance scripts from Downloads
    - Accounting staff using internal 1C automation scripts with similar names
level: high
```

**Known false positives:**

- Administrators running legitimate logon or maintenance .bat/.vbs scripts from Downloads or Temp
- Accounting staff using internal 1C automation scripts whose names contain 'sverki' or 'akt'

**Tuning notes:** Add known internal automation script names and signed-script paths to an allowlist lookup. Extend the lure regex with new pretexts (payment orders, invoices) as they appear. Raise severity when the same host later shows RegAsm.exe spawned by the script host (see SPL-002).

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- VasyGrek Reconciliation-Act Phishing Email With Archive/Script Attachment or Lure Link (locked: unlock with TL Creds)
- PowerShell Steganography Downloader Fetching Image With Embedded BASE64 Assembly (locked: unlock with TL Creds)
- Script Host (wscript/cscript) Making Outbound Connection to Public Internet (locked: unlock with TL Creds)
- Batch Script Launching Hidden or Encoded PowerShell From Download Path (locked: unlock with TL Creds)
- RegAsm.exe Outbound Network Connection (Injected PureHVNC RAT C2) (locked: unlock with TL Creds)
- XMRig Cryptominer Execution (VasyGrek Resource Hijacking) (locked: unlock with TL Creds)
- RegAsm.exe Spawned by Script Host or PowerShell (PureHVNC Injection Target) (locked: unlock with TL Creds)
- VasyGrek C2 Infrastructure Contact ([indicator], [indicator], [indicator]) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 16)

Defanged, TLP:CLEAR.

- IP address: `195.26.227[.]209`
- Domain: `1c-buh-akt[.]ru`
- IP address: `195.26.225[.]113`

Full set of 16 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Russian Police Arrest 3 Suspected VasyGrek Hackers, Dismantle Criminal Infrastructure](https://thehackernews.com/2026/11/russian-police-arrest-3-suspected.html)
- [Fluffy Wolf and reconciliation acts: how VasyGrek targets Russian accountants in 2025 (SecurityLab)](https://www.securitylab.ru/news/566503.php)
- [VasyGrek intensified phishing against Russian organizations, changing tools (Anti-Malware.ru, citing F6)](https://www.anti-malware.ru/news/2025-11-25-111332/48180)
- [VasyGrek and Mr.Burns campaign analysis (F.A.C.C.T. on Habr)](https://habr.com/ru/articles/827346)
- [Accounting as bait: new details of VasyGrek attacks on Russian companies (SecurityLab)](https://securitylab.ru/news/549925.php)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5225