VasyGrek arrests: how Russia polices its own hackers

Russia’s Interior Ministry says police have dismantled VasyGrek, also known as Fluffy Wolf, a hacking group that mainly targeted Russian companies, according to The Record, which calls the arrests a rare public crackdown. The ministry’s statement of 2 November says all of the group’s members were identified, with the organiser under house arrest and two accomplices under travel restrictions.

The case is notable because Russian-speaking cybercriminals have spent years building their operations around an assumption: avoiding victims at home makes prosecution less likely. VasyGrek appears to have ignored that convention.

The lure was ordinary. According to the ministry, an accountant at one company opened an email attachment called “Акт сверки” (a reconciliation statement) in September 2025, apparently sent by a business partner, and gave the attackers remote access to the company’s online banking. They allegedly moved more than 660,000 rubles, about $8,000, to accounts they controlled. Kaspersky said the same day that it had logged more than 100 attempted attacks by the group between January and September 2026, on organisations in Russia, Belarus and Kazakhstan.

The line may run through the victim

VasyGrek was hardly an unknown group. The Russian security firm BI.ZONE profiled its activity in 2024 and counted at least 140 attacks on Russian companies since 2022, as summarised by Anti-Malware.ru. But identifying a hacking group is not the same as identifying its members or assembling a prosecutable case, and the public record says little about why the authorities acted now.

The arrests fit a familiar pattern. Russian-speaking cybercriminals have long treated Russia and the other Commonwealth of Independent States (CIS) countries as territory to avoid. Photon Research reported in 2021 that Russian-language criminal platforms write the rule into their membership terms, and that malware often checks a computer’s language settings before running. That is a statement of criminals’ expectations, not of state policy. ThreatDown’s explanation is pragmatic: gangs expect no penalty from inside the CIS if they leave its organisations alone, and Russia has no extradition treaty with the United States. The rule is self-preservation, not ethics. When a Nova ransomware affiliate hit Eriell Group, an Uzbekistan-based oilfield services firm, in 2026, the gang reportedly apologised, banned the affiliate and offered free recovery help, according to The Register, which relays the criminals’ own account.

VasyGrek did the opposite. According to Kaspersky, it went after government institutions, metallurgical firms and energy companies, among others. Whether that explains the arrests is unknown. Its victims, its visibility, the evidence available to investigators or its changing techniques could each have mattered, and Kaspersky describes attacks that grew more complex in 2026, with multi-stage infection chains, a Golang backdoor and the Pay2Key ransomware. The ministry’s own account of the toolkit is brief. As relayed by Security Lab and The Hacker News, it says the group used phishing domains imitating financial and accounting sites, virtual servers in other countries and covert remote-administration software bought on the darknet. The ministry names none of the malware; those names come from researchers. Neither report says whether the foreign hosting helped or hindered investigators.

Past enforcement has followed domestic victims and foreign requests

In 2016 Russian police shut down the group behind the Lurk banking trojan, with technical evidence from Kaspersky. Kaspersky’s account says police suspected the gang of stealing close to three billion rubles, mostly from Russian victims, and that the arrests followed about six years of investigation by Kaspersky’s own researchers. The case shows Russia acting against a group with domestic victims. The six years show how long evidence-gathering can take, although they do not establish when Russian police began their own investigation or when they had enough to prosecute.

A second pattern involves foreign requests. On 14 January 2022 the FSB said it had detained 14 members of the REvil ransomware gang after a request from the United States. Reuters called it a rare apparent demonstration of collaboration between the two countries at a time of high tension over Ukraine, and an Interfax source said members with Russian citizenship would not be handed over to Washington. Krebs noted that President Biden had told Putin the previous autumn to expect Russia to act when the United States shared information on specific Russians involved in ransomware, and that many experts saw the crackdown as part of an effort to reduce tensions over Ukraine. Dmitri Alperovitch called it “ransomware diplomacy”. Intel 471 analysts called the arrests unprecedented and suggested they may have been a gesture to Western governments, although the motive remains uncertain.

The cases differ: one involved domestic victims, the other an acknowledged foreign request. Neither establishes a general rule governing Russian enforcement. But both challenge the idea that operating from Russia provides permanent immunity. What remains unclear is when the authorities decide to act, and why. In practice, criminals keep their autonomy, and the state keeps its discretion. VasyGrek shows that discretion in use, for reasons the public record does not yet reveal. It does not show a change of policy.

New essays and snapshots land by email, roughly weekly. Subscribe here.

The unwritten rules of Russian cybercrime

Russian-speaking cybercrime has developed its own conventions for living with the state. Rules appear in forum terms and affiliate contracts, and groups discipline their own members. How far the relationship goes beyond avoidance is disputed. Some experts have told Axios that the security services let criminals work as long as they also take state-ordered missions. ThreatDown says that is not the prevailing view. Rules written by criminals reflect what criminals believe about enforcement, which may or may not match what officials intend. The VasyGrek announcement settles neither question.

It does add two complications. The ministry says the group targeted Russian and foreign companies, but the only data published, Kaspersky’s, covers Russia, Belarus and Kazakhstan, and Kaspersky says Belarusian and Kazakh companies joined the target list this year. A group widening its reach within the CIS may have been testing the edge of the protected zone, or the timing may be coincidence. The ministry also said the group was known to law enforcement in Russia, the United States and Europe, without saying whether foreign agencies helped. Neither point shows foreign pressure. Both are worth watching as the case moves through court.

Routine policing and selective power can coexist

The strongest counter-reading is that this is ordinary law enforcement. VasyGrek stole from Russian companies, including state bodies, and a state that tolerates crime against foreigners can still prosecute crime against its own firms. The ministry’s statement presents a conventional criminal case, citing theft, malware offences and the alleged creation of a legal entity using nominee individuals under Article 173.1 of Russia’s Criminal Code, and The Record says the theft and malware charges carry up to ten and five years respectively. But ordinary policing and selective state power are not mutually exclusive. The interesting question is how consistently the law is enforced, and the public record cannot yet answer it: it does not say how many other groups attacking Russian organisations have been left alone.

VasyGrek’s arrest does not tell us whether Moscow has changed its approach to cybercrime. It tells us something narrower. A criminal ecosystem built around the expectation of selective enforcement can never be certain where its protection ends. The boundary may be a Russian victim, an international negotiation, a sufficiently serious investigation or a decision made for reasons outsiders never learn. The apparent freedom of Russia’s cybercriminals exists alongside the state’s enduring power to take it away.

Sources: Russian Interior Ministry statement, 2 November 2026 (read directly); Kaspersky press release, 2 November 2026 (read directly); The Record (Recorded Future News); BI.ZONE research, as summarised by Anti-Malware.ru; Photon Research, as reported by Fox News; ThreatDown; The Register, on the Nova apology; Security Lab and The Hacker News, relaying the ministry’s account of the tools; Kaspersky’s Securelist account of the Lurk investigation; Reuters, 14 January 2022, on the REvil arrests (read as published by Euronews); Krebs on Security, 14 January 2022 (read in full); Intel 471, as reported by Security Boulevard; Axios.