Rossiya rasmiylari VasyGrek nomi bilan tanilgan tahdid guruhining uchta gumondor a’zosini hibsga oldi va uning jinoiy infratuzilmasini yo‘q qildi.
Fluffy Wolf nomi bilan ham tanilgan bu tahdid aktori 2016-yildan beri Rossiya va xalqaro kompaniyalarni nishonga olish tarixi bilan ajralib turadi.
Rossiya Federatsiyasi Ichki ishlar vazirligi (MVD) guruh a’zolari "tashkilotlar hisoblaridan mablag‘larni o‘g‘irlash, shuningdek, zararli dasturiy ta’minotni yaratish, tarqatish va ishlatishda gumon qilinmoqda" deb ma’lum qildi.
Vazirlik ta’kidlagan 2025-yil sentyabr oyidagi bir holatda, hujumchilar nomi oshkor etilmagan tashkilotga biznes yozishmasi niqobi ostida fishing elektron pochtasi yuborib, qabul qiluvchilarga yarashish hisobotini ochishni buyurgan, bu esa zararli dasturiy ta’minotning ishga tushishiga sabab bo‘lgan.
Bu hodisa natijasida tashkilotning bank hisobidan 660 000 rubl (8 000 dollar) yo‘qotilgan, hujumchilar mablag‘larni o‘z nazoratidagi hisob raqamlariga o‘tkazgan.
"Hujumlar moliyaviy va buxgalteriya xizmatlari veb-saytlarini taqlid qiluvchi keng fishing domenlari tarmog‘i, shuningdek, xorijiy mamlakatlarda joylashgan virtual serverlardan foydalangan", — dedi MVD. "Yashirin masofaviy boshqaruv vositalari qorong‘u vebdan sotib olingan."
Kam uchraydigan huquqni muhofaza qilish harakati doirasida Rossiya rasmiylari gumondorlarning yashash joylari va operatsiyalarni amalga oshirish uchun foydalanilgan ofis binolarida tintuv o‘tkazdi. Bu, shuningdek, kompyuter uskunalari, aloqa qurilmalari va daliliy ahamiyatga ega boshqa buyumlarning musodara qilinishiga olib keldi.
Rossiya kiberxavfsizlik kompaniyasi BI.ZONE va F6 hisobotlariga ko‘ra, VasyGrek moliyaviy manfaatdor tahdid aktori sifatida baholanadi, u moliyaviy hujjatlar niqobi ostidagi ilovalar bilan fishing elektron pochtalari yuborish orqali dastlabki kirishni qo‘lga kiritadi.
Uning arsenalidagi asosiy vositalar orasida MetaStealer, PureCrypter, PureLogs Stealer, WarZone RAT, XMRig, BurnsRAT, PureHVNC, PureRAT, Pay2Key va PowerLoader kabi tayyor o‘g‘irlik dasturlari va troyanlar, shuningdek, Remote Utilities kabi qonuniy masofaviy kirish dasturiy ta’minoti ham bor.
Shu hafta e’lon qilingan hisobotda Kaspersky 2026-yil yanvar-sentyabr oylarida Rossiya, Belarus va Qozog‘istondagi tashkilotlarga qarshi VasyGrek tomonidan uyushtirilgan 100 dan ortiq hujum urinishini qayd etganini ma’lum qildi. Bu hujumlarda, shuningdek, zararlangan qurilmada ixtiyoriy buyruqlarni bajarishga qodir Golang orqa eshikni tushirish uchun aldov hujjatlaridan foydalanilgani kuzatilgan.
Hujumlar asosan metallurgiya sohasidagi tashkilotlar, shuningdek, xom ashyo va sanoat ta’minoti ulgurji yetkazib beruvchilari va davlat idoralarini nishonga olgan. Boshqa nishonlar orasida sog‘liqni saqlash, neft va gaz, energetika, moliya va qishloq xo‘jaligi sohalaridagi tashkilotlar ham bor.
"Guruh hujum geografiyasini kengaytirdi: avval uning asosiy nishoni Rossiya tashkilotlari bo‘lgan bo‘lsa, bu yil Belarus va Qozog‘iston kompaniyalari ham potentsial qurbonlar qatoriga kirdi", — dedi Kasperskydagi ilg‘or tahdid tadqiqotlari rahbari Nikita Nazarov.
"Hujumchilar ko‘p bosqichli infeksiya sxemalari va zararli komponentlarni joylashtirish uchun qonuniy onlayn xizmatlardan foydalandi, bu ularning faoliyatini yashirish va hujum tahlilini qiyinlashtirishga yordam berdi."
Bu rivojlanish BI.ZONE LxBase RAT, CoreRAT va NightStrike RAT kabi zararli dasturiy ta’minot oilalaridan foydalangan holda Rossiya tashkilotlariga qaratilgan bir nechta hujumni aniqlagan paytda sodir bo‘ldi.
Oyiga 119 dollar turadigan tijorat troyani LxBase RAT ommaviy fishing kampaniyalari orqali tarqatiladi, CoreRAT infeksiya zanjirlari esa yetkazib berish uchun 7zSFX va Rust tushiruvchilarni o‘z ichiga olgan fishing elektron pochtalaridan foydalanadi. Bu faoliyat Core Werewolfga bog‘langan, u Vortex Werewolf bilan ma’lum darajada o‘xshashlikka ega deb baholanadi.
NightStrike RATni joylashtiruvchi hujumlar Insolent Werewolf deb nomlangan xaker-aktivistdan kiberjosuslik klasteriga bog‘langan. Dastlabki kirish masofaviy kirishni qo‘lga kiritish uchun NetSupport Managerni joylashtirish maqsadida ClickFix uslubidagi hujumlar yordamida amalga oshiriladi.
"Insolent Werewolf, shuningdek, buzilgan tizimlarda AdaptixC2 va Havoc post-ekspluatatsiya ramkasi implantlarini joylashtirish uchun Octowave Loaderdan foydalanadi", — dedi BI.ZONE, guruhning zararli dasturiy ta’minot arsenaliga CapDoor va NightWire kabi boshqa masofaviy kirish troyanlari ham kirishini qo‘shimcha qildi.
"C++ tilida yozilgan RAT NightStrike, kodlash uslubidagi o‘xshashliklarga asoslanib, NightWire ishlab chiquvchisi tomonidan yaratilgan deb taxmin qilinadi. Turli ramkalar va o‘zlarining maxsus zararli dasturiy ta’minotidan foydalanish dushmanga hujum sharoitlariga moslashish va aniqlanish ehtimolini kamaytirish imkonini beradi."
Russian authorities have arrested three suspected members of a threat group known as VasyGrek and dismantled its criminal infrastructure.
Also known as Fluffy Wolf, the threat actor has a history of targeting Russian and international companies since 2016.
The Ministry of Internal Affairs of the Russian Federation (MVD) said members of the group are "suspected of embezzling funds from the accounts of organizations, as well as creating, distributing, and using malicious software."
In one September 2025 case highlighted by the ministry, the attackers are said to have sent a phishing email to an unnamed organization, masquerading it as business correspondence and instructing recipients to open a reconciliation report that triggered the execution of malware.
The incident resulted in losses of 660,000 rubles ($8,000) from the organization's bank account, with the attackers transferring the funds to accounts under their control.
"The attacks utilized a vast network of phishing domains imitating financial and accounting service websites, as well as virtual servers located in foreign countries," MVD said. "Tools for covert remote administration were acquired from the dark web."
The rare law enforcement action saw Russian authorities conducting searches at the suspects' residences and the office premises they used to conduct the operations. It also led to the seizure of computer equipment, communication devices, and other items of evidentiary value.
According to reports from Russian cybersecurity company BI.ZONE and F6, VasyGrek is assessed to be a financially motivated threat actor that gains initial access by sending phishing emails with attachments disguised as financial documents.
Some of the key tools in its arsenal include off-the-shelf stealers and trojans, like MetaStealer, PureCrypter, PureLogs Stealer, WarZone RAT, XMRig, BurnsRAT, PureHVNC, PureRAT, Pay2Key, and PowerLoader, as well as legitimate remote access software such as Remote Utilities.
In a report published this week, Kaspersky said it recorded over 100 attempted attacks orchestrated by VasyGrek against organizations in Russia, Belarus, and Kazakhstan between January and September 2026. These attacks have also been observed using decoy documents to drop a Golang backdoor capable of executing arbitrary commands on the infected device.
The attacks primarily singled out entities in the metallurgical sector, along with wholesale suppliers of raw materials and industrial supplies and government agencies. Other targets included organizations in the healthcare, oil and gas, energy, finance, and agriculture sectors.
"The group expanded its attack geography: while previously its primary target was Russian organizations, this year, potential victims also included companies from Belarus and Kazakhstan," Nikita Nazarov, head of advanced threat research at Kaspersky, said.
"The attackers used multi-stage infection schemes and legitimate online services to host malicious components, which helped conceal their activity and hinder attack analysis."
The development comes as BI.ZONE it detected multiple attacks targeting Russian organizations using malware families like LxBase RAT, CoreRAT, and NightStrike RAT.
While LxBase RAT, a commercial trojan that costs $119 per month, is distributed via mass phishing campaigns, CoreRAT infection chains make use of phishing emails containing 7zSFX and Rust droppers for delivery. The activity has been attributed to Core Werewolf, which is assessed to share some level of overlap with Vortex Werewolf.
Attacks deploying NightStrike RAT have been associated with a hacktivist-turned-cyber espionage cluster dubbed Insolent Werewolf. Initial access is achieved using ClickFix-style attacks to deploy NetSupport Manager to gain remote access.
"Insolent Werewolf also utilizes Octowave Loader to deploy AdaptixC2 and Havoc post‑exploitation framework implants in compromised systems," BI.ZONE said, adding the group's malware arsenal includes other remote access trojans like CapDoor and NightWire.
"A RAT written in C++, NightStrike has presumably been created by the developer of NightWire, based on similarities in coding style. Utilizing diverse frameworks and their own custom malware allows the adversary to tailor tooling to specific attack conditions and reduce the likelihood of detection."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.