Russian Police Arrest 3 Suspected VasyGrek Hackers, Dismantle Criminal Infrastructure
Law enforcement has taken action against VasyGrek, according to the latest reporting on the case.
Russian authorities have arrested three suspected members of a threat group known as VasyGrek and dismantled its criminal infrastructure.
The Ministry of Internal Affairs of the Russian Federation (MVD) said members of the group are "suspected of embezzling funds from the accounts of organizations, as well as creating, distributing, and using malicious software." In one September 2025 case highlighted by the ministry, the attackers are said to have sent a phishing email to an unnamed organization, masquerading it as business correspondence and instructing recipients to open a reconciliation report that triggered the execution of malware.
According to reports from Russian cybersecurity company BI.ZONE and F6, VasyGrek is assessed to be a financially motivated threat actor that gains initial access by sending phishing emails with attachments disguised as financial documents.
While LxBase RAT, a commercial trojan that costs $119 per month, is distributed via mass phishing campaigns, CoreRAT infection chains make use of phishing emails containing 7zSFX and Rust droppers for delivery.
The incident resulted in losses of 660,000 rubles ($8,000) from the organization's bank account, with the attackers transferring the funds to accounts under their control.
In a report published this week, Kaspersky said it recorded over 100 attempted attacks orchestrated by VasyGrek against organizations in Russia, Belarus, and Kazakhstan between January and September 2026.
Using diverse frameworks and their own custom malware allows the adversary to tailor tooling to specific attack conditions and reduce the likelihood of detection."
Some of the key tools in its arsenal include off-the-shelf stealers and trojans , like MetaStealer, PureCrypter, PureLogs Stealer, WarZone RAT, XMRig, BurnsRAT, PureHVNC, PureRAT, Pay2Key, and PowerLoader, as well as legitimate remote access software such as Remote Utilities.
These attacks have also been observed using decoy documents to drop a Golang backdoor capable of executing arbitrary commands on the infected device.
Initial access is achieved using ClickFix -style attacks to deploy NetSupport Manager to gain remote access.
What happened
Russian authorities have arrested three suspected members of a threat group known as VasyGrek and dismantled its criminal infrastructure.
The Ministry of Internal Affairs of the Russian Federation (MVD) said members of the group are "suspected of embezzling funds from the accounts of organizations, as well as creating, distributing, and using malicious software." In one September 2025 case highlighted by the ministry, the attackers are said to have sent a phishing email to an unnamed organization, masquerading it as business correspondence and instructing recipients to open a reconciliation report that triggered the execution of malware.
What changed
According to reports from Russian cybersecurity company BI.ZONE and F6, VasyGrek is assessed to be a financially motivated threat actor that gains initial access by sending phishing emails with attachments disguised as financial documents.
While LxBase RAT, a commercial trojan that costs $119 per month, is distributed via mass phishing campaigns, CoreRAT infection chains make use of phishing emails containing 7zSFX and Rust droppers for delivery.
Who is affected
The incident resulted in losses of 660,000 rubles ($8,000) from the organization's bank account, with the attackers transferring the funds to accounts under their control.
In a report published this week, Kaspersky said it recorded over 100 attempted attacks orchestrated by VasyGrek against organizations in Russia, Belarus, and Kazakhstan between January and September 2026.
Why it matters
Using diverse frameworks and their own custom malware allows the adversary to tailor tooling to specific attack conditions and reduce the likelihood of detection."
Some of the key tools in its arsenal include off-the-shelf stealers and trojans , like MetaStealer, PureCrypter, PureLogs Stealer, WarZone RAT, XMRig, BurnsRAT, PureHVNC, PureRAT, Pay2Key, and PowerLoader, as well as legitimate remote access software such as Remote Utilities.
Technical details
These attacks have also been observed using decoy documents to drop a Golang backdoor capable of executing arbitrary commands on the infected device.
Initial access is achieved using ClickFix -style attacks to deploy NetSupport Manager to gain remote access.
Response
Attacks deploying NightStrike RAT have been associated with a hacktivist-turned-cyber espionage cluster dubbed Insolent Werewolf.
Attribution
The Hacker News: Russian authorities have arrested three suspected members of a threat group known as VasyGrek and dismantled its criminal infrastructure.
What to watch next
Watch for updated vendor guidance and fixed-version details.