Fluffy Wolf

Fluffy Wolf is a threat actor observed conducting phishing-led intrusions against Russian organizations. Between March and May 2026, BI.ZONE Threat Intelligence reported campaigns targeting companies in construction, consulting, engineering, retail, e-commerce, manufacturing/industry, using emails themed as outstanding debts, reconciliation statements, claims, and other business communications, often impersonating partners or contractors. The actor used malicious RAR archives delivered either directly as attachments or via GitHub repository links to improve legitimacy and evade email filtering and other defenses. In the reported campaigns, Fluffy Wolf used loaders and droppers to deliver PureLogs, PureRAT, and Pay2Key ransomware. The group continued using PureCrypter and Rust-based loaders running Donut shellcode, and introduced PowerLoader, an undocumented C++ downloader sold as a malware-as-a-service offering. PowerLoader operated largely filelessly, launched hidden PowerShell instances, retrieved scripts from command-and-control infrastructure, and downloaded PureCrypter to deploy final payloads. Payloads were injected into legitimate Windows processes including RegAsm.exe, InstallUtil.exe, and MSBuild.exe. Observed post-compromise tooling included PureLogs, which stole browser credentials, cookies, search or browser history, application data, and email client data; researchers also noted that stolen data was categorized and sent to separate server endpoints. Fluffy Wolf also used PureRAT, including a version with the PluginRemoteDesktop module, which BI.ZONE said was seen for the first time in attacks on Russian organizations. That module enabled desktop image capture, active window monitoring, remote desktop control, keyboard and mouse emulation, and sending messages to application windows. At least one incident involved deployment of Pay2Key ransomware, described as based on Mimic. Reported anti-forensic behavior included overwriting its own executable with zeros using fsutil before deletion, hindering incident response and reverse engineering. No additional aliases or sub-groups were provided in the source content beyond Fluffy Wolf.