Bloody Wolf Targets Uzbekistan and Russia with NetSupport RAT Attacks
- Securityish
- Threats & Incidents
Quick Summary
The threat actor Bloody Wolf is conducting spear-phishing campaigns targeting Uzbekistan and Russia, utilizing the NetSupport RAT to compromise systems. Kaspersky reports around 50 victims in Uzbekistan and 10 in Russia, with attempts also noted in Kazakhstan and Turkey. The attacks leverage malicious PDF attachments to deliver the RAT, indicating a potential focus on financial gain and cyber espionage.
The Securityish Brief
The cyber espionage group known as Bloody Wolf has been linked to a series of spear-phishing attacks targeting Uzbekistan and Russia, utilizing a remote access trojan (RAT) called NetSupport. Kaspersky, a cybersecurity vendor, has been tracking this activity since at least 2023, identifying approximately 50 victims in Uzbekistan and 10 in Russia, with additional infections reported in Kazakhstan, Turkey, Serbia, and Belarus.
The attack methodology involves phishing emails containing malicious PDF attachments. These documents embed links that, when clicked, download a malicious loader, which then installs the NetSupport RAT. The loader also implements various tactics to ensure persistence on the infected systems, such as configuring autorun scripts and scheduled tasks.
Bloody Wolf’s previous attacks utilized a different RAT known as STRRAT, indicating a shift in their tactics. The group appears to be targeting sectors such as manufacturing, finance, and IT, suggesting a dual motive of financial gain and potential espionage.
Kaspersky has noted that the use of NetSupport, a legitimate remote administration tool, marks a significant change in the group’s approach. The campaign has been characterized by its high volume, with over 60 targets affected, which underscores the resources Bloody Wolf is willing to invest in its operations.
In addition to the NetSupport RAT, Kaspersky has identified Mirai botnet payloads associated with Bloody Wolf, suggesting an expansion of their malware arsenal to include IoT devices. This diversification of tactics raises concerns about the potential for broader impacts on various sectors.
Implications for Cybersecurity
The ongoing campaigns against Russian organizations by Bloody Wolf and other groups highlight the increasing sophistication of cyber threats in the region. Organizations must remain vigilant against phishing attempts and ensure robust security measures are in place to mitigate risks.
As cyber threats evolve, users and organizations should be aware of the signs of phishing attacks, such as unexpected emails with attachments or links. Regular training and awareness programs can help reduce the risk of falling victim to such campaigns.
Monitoring for unusual activity on networks and ensuring that all software is up to date can also help defend against these types of attacks. Organizations should consider implementing multi-factor authentication and other security best practices to enhance their defenses.
Key Takeaways
- Be cautious of unexpected emails, especially those with attachments or links, as they may contain phishing attempts.
- Regularly update all software and security tools to protect against known vulnerabilities.
- Implement multi-factor authentication to add an extra layer of security to sensitive accounts.
- Conduct regular training for employees on recognizing phishing attacks and safe online practices.
- Monitor network activity for unusual behavior that may indicate a compromise.
Key Terms & Concepts
- NetSupport RAT: In this article, NetSupport RAT refers to a remote access trojan used by the Bloody Wolf group to compromise systems.
- spear-phishing: Spear-phishing is a targeted attempt to steal sensitive information from specific individuals, often through deceptive emails.
- Kaspersky: Kaspersky is a cybersecurity vendor that tracks and analyzes cyber threats, including the activities of threat actors like Bloody Wolf.
- Mirai botnet: The Mirai botnet is a network of compromised IoT devices used to launch distributed denial-of-service attacks.
Read the original article here: https://thehackernews.com/2026/02/bloody-wolf-targets-uzbekistan-russia.html
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
