Bloody Wolf Expands Java-based NetSupport RAT Attacks in Kyrgyzstan and Uzbekistan
Since at least June 2025, Kyrgyzstan has been the subject of a cyberattack campaign by the threat actor Bloody Wolf, which aims to deliver NetSupport RAT.
In a paper released in partnership with Ukuk, a state corporation under the Kyrgyz Republic's Prosecutor General's office, Group-IB researchers Amirbek Kurbanov and Volen Kayo stated that as of October 2025, the activity has expanded to specifically target Uzbekistan. The information technology (IT), government, and financial sectors have been the targets of the attacks.
According to the Singapore-based business, those threat actors would pose as the [Kyrgyzstan's] Ministry of Justice by using official-looking PDF documents and domain names that held malicious Java Archive (JAR) files intended to launch the NetSupport RAT.
Bloo...