Fluffy Wolf

Fluffy Wolf is a financially motivated cybercriminal threat actor known for phishing-led intrusions against organizations in Russia. Between March and May 2026, the group conducted campaigns against companies in construction, consulting, engineering, retail, e-commerce, manufacturing, and broader industrial sectors. Its lures impersonated routine business communications such as debt notices, reconciliation statements, and legal or financial claims, often posing as partners or contractors. The actor relies heavily on commodity and malware-as-a-service tooling rather than bespoke malware development. Observed delivery chains used malicious archives and links to externally hosted archives to evade email filtering and network defenses. Fluffy Wolf has deployed PureCrypter, Rust-based loaders using Donut shellcode, and a C++ downloader referred to as PowerLoader. PowerLoader operates largely filelessly, launches hidden PowerShell to retrieve additional scripts, and is used to stage subsequent payload delivery. Payloads associated with Fluffy Wolf operations include the Pay2Key ransomware, the PureLogs information stealer, and PureRAT. PureLogs has been used to harvest credentials, cookies, browser history, and other application data, while operators separated exfiltrated data by category for downstream processing. PureRAT activity included use of the PluginRemoteDesktop module, enabling remote desktop surveillance and interaction such as screen capture, active-window monitoring, and mouse and keyboard control. The group has also used process injection into legitimate Windows utilities to blend malicious execution with trusted processes and improve defense evasion. In ransomware incidents, Pay2Key exhibited anti-forensic self-deletion behavior by overwriting its executable before removal, complicating incident response and reverse engineering.