Kaspersky: VasyGrek hacker group made more than 100 attack attempts on organisations in Belarus, Russia and Kazakhstan

In the first three quarters of 2026, Kaspersky experts recorded more than 100 attack attempts by the VasyGrek hacker group, also known as Fluffy Wolf, on organisations in Belarus, Russia and Kazakhstan.

Nikita Nazarov, head of the advanced threat research department at Kaspersky, said: "In 2026 we observed changes in VasyGrek's activity. The group has expanded the geography of its attacks: whereas previously its main target was Russian organisations, this year companies from Belarus and Kazakhstan are also among the potential victims."

While analysing the group's activity, Kaspersky identified a previously undescribed scenario: the attackers used phishing emails to install a backdoor, that is, a program for covert remote access.

Potential victims received emails with links to archives disguised as accounting documents. Inside were malicious installer files.

When such a file was launched, a decoy file opened, creating the appearance of working with an ordinary document. At the same time, a legitimate process was started, into which a backdoor written in Golang was loaded. The backdoor communicated with command servers, through which the attackers sent commands and received the results of their execution.

According to Kaspersky experts, the attackers used multi-stage infection chains with droppers, programs that install other malicious components. In one scenario, a malicious script downloaded additional components from legitimate internet services.

Droppers written in Rust installed the PureRAT backdoor. It established itself in the system and allowed remote control of the infected device, including access to confidential information. PureRAT's capabilities were extended by the PluginRemoteDesktop plugin, which provides remote control of the desktop.

In 2025–2026 the group's arsenal was supplemented by the PowerLoader loader, which uses techniques for evading security solutions, and the Pay2Key ransomware.

According to Kaspersky, the most frequent targets were metallurgical enterprises, companies engaged in wholesale supplies of raw materials and industrial materials, and government institutions. Among the targets were also organisations in healthcare, oil and gas, energy, finance and agribusiness.

Kaspersky does not say, in the information provided, which Belarusian organisations were among the targets or whether any of them had data stolen.

Nazarov noted that the attackers continued to use familiar social engineering methods: "At the same time, the attackers continued to use familiar social engineering methods: they sent phishing emails disguised as business correspondence, for example on accounting topics or reconciliation statements."

According to him, the technical side of the attacks has become more complex: the attackers used multi-stage infection schemes and legitimate internet services to host malicious components, which helped conceal their activity and made analysis of the attacks harder.