Fluffy Wolf tests new toolkit on Russian companies

From March to May 2026, we uncovered a series of phishing attacks by Fluffy Wolf. The threat actor targeted Russian organizations across multiple sectors, including construction, consulting, manufacturing, engineering, retail, and e-commerce. To deliver malware, the adversaries employed malicious email attachments and GitHub repository URLs that directed victims to infected archives. The cluster also relied on multiple loaders, droppers, and a downloader, including:…

Diamond Model