Russian authorities arrested three suspected members of VasyGrek, also known as Fluffy Wolf, a financially motivated group that used targeted phishing to access corporate systems and steal money. In one documented case, an accounting employee opened a malicious attachment disguised as a routine financial document from a business partner, allowing the attackers to access online banking and transfer funds.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A routine document from a business partner? That’s the trap. VasyGrek, also called Fluffy Wolf, sent accounting staff emails saying, ‘Please find the routine financial document attached.’ In one case, opening it reportedly gave remote access to the computer and company online banking. The aha moment: a familiar partner name doesn’t make the file safe. An unexpected attachment, a mismatched reply-to, or ‘Enable Content’ can turn a document into a doorway. Before opening an unexpected financial attachment, confirm it with your partner using a phone number you already know.
Researchers report that the threat actor Silent Lynx ran multiple real-world spear‑phishing campaigns against government organizations across Central Asia and the wider CIS region. Victims were lured with official-looking documents (e.g., diplomatic letters, airspace applications, and oil refinery…
Researchers tracked Kazakhstan-nexus group UAT-6275 (TAG-193) targeting government organizations across Central Asia and the wider CIS using convincing decoy documents tied to diplomacy and energy. The campaigns used malicious files (macro-enabled Word docs, shortcuts, and a WinRAR exploit) to…
Researchers report real-world campaigns targeting European government and diplomatic organizations using diplomatic-themed Microsoft Word documents. Victims are prompted to click “Enable Content,” which runs malicious macros that install the HOOKEDGE backdoor and connect to webhook-based…
A real phishing campaign targeted Indian businesses and individual taxpayers by impersonating government departments and sending emails that look like official GST tax notices. The goal was to trick recipients into opening convincing “refund/compliance” documents that install Remcos RAT to steal…
Attackers are using Microsoft Teams external chat to pose as internal IT support staff, often after overwhelming employees with email subscription messages. They persuade victims to join a voice call, approve remote-control tools, or run commands, with some incidents ending in malware infections…
Attackers are using fake calendar invitations to bypass normal email defenses and lure people into credential theft or malware downloads. The invites may appear in a user’s calendar even when the related phishing email is quarantined, making unexpected meeting entries a new route for account and…
