Russian police arrested three suspected VasyGrek members after the group allegedly stole money from an organization through a phishing email. The attackers disguised the message as routine business correspondence and asked recipients to open a reconciliation report, which ran malware and enabled a bank-account theft. The group has reportedly targeted industrial, government, healthcare, energy, finance, and agriculture organizations across Russia, Belarus, and Kazakhstan.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
“Please open the attached reconciliation report.” Sound routine? That was VasyGrek’s pitch. In one reported case, opening the file ran malware. The organization lost 660,000 rubles, about eight thousand dollars, from its bank account. The giveaway isn’t a typo. It’s a financial report you never requested, with barely any explanation. Even the sender’s accounting-service domain can be a lookalike. Unexpected reconciliation report? Before opening it, call your known contact using a number you already have.
Russian authorities arrested three suspected members of VasyGrek, also known as Fluffy Wolf, a financially motivated group that used targeted phishing to access corporate systems and steal money. In one documented case, an accounting employee opened a malicious attachment disguised as a routine…
Researchers tracked Kazakhstan-nexus group UAT-6275 (TAG-193) targeting government organizations across Central Asia and the wider CIS using convincing decoy documents tied to diplomacy and energy. The campaigns used malicious files (macro-enabled Word docs, shortcuts, and a WinRAR exploit) to…
A real phishing campaign targeted Indian businesses and individual taxpayers by impersonating government departments and sending emails that look like official GST tax notices. The goal was to trick recipients into opening convincing “refund/compliance” documents that install Remcos RAT to steal…
Attackers reportedly spent months targeting Binance engineers, using a tampered software installer and fake job interviews with a malicious technical assignment. After gaining access through employee devices and credentials, they abused internal systems to authorize transfers from Binance hot…
Attackers are using Microsoft Teams external chat to pose as internal IT support staff, often after overwhelming employees with email subscription messages. They persuade victims to join a voice call, approve remote-control tools, or run commands, with some incidents ending in malware infections…
Attackers are using fake calendar invitations to bypass normal email defenses and lure people into credential theft or malware downloads. The invites may appear in a user’s calendar even when the related phishing email is quarantined, making unexpected meeting entries a new route for account and…
