Threat video1:00
VasyGrek Fluffy Wolf Phishing Crew: Detection & IOCs
Russian police arrested three suspected VasyGrek members; their accounting-lure phishing may continue. 9 detection rules, 16 IOCs, free Splunk SPL rule.
Read the full threat intel for VasyGrek Fluffy Wolf Phishing Crew: Detection & IOCs →
Chapters
- 0:00The hookFluffy Wolf phishing ring disrupted; three arrested.
- 0:04The storyFinancially motivated phishing since 2016.
- 0:11Attack pathReportedly phishing with accounting lures and archives.
- 0:31AttributionAttributed to VasyGrek.
- 0:35Indicators of compromise4 indicators to hunt: 2 IPs, 1 domain and 1 file name.
- 0:40MITRE ATT&CK techniques17 ATT&CK techniques, from resource development to impact.
- 0:44Remediation9 remediation steps are listed, 3 of them immediate.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Fluffy Wolf phishing ring disrupted; three arrested.
0:05Financially motivated phishing since 2016.
0:08Three suspected members arrested in November.
0:12Reportedly phishing with accounting lures and archives.
0:15VBS script loads steganography decoder; RegAsm.exe infected.
0:21PureHVNC remote access; credentials stolen from systems.
0:25Bank funds transferred; infrastructure dismantled by MVD.
0:31Attributed to VasyGrek. Confidence: medium.
0:354 indicators to hunt: 2 IPs, 1 domain and 1 file name.
0:4017 ATT&CK techniques, from resource development to impact.
0:459 remediation steps are listed, 3 of them immediate.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.