Bloody Wolf Expands Java-Based NetSupport RAT Campaign in Central Asia

Bloody Wolf, a Central Asian threat group, expanded its Java-based NetSupport RAT campaign from Kyrgyzstan into Uzbekistan since June 2025, targeting finance, government, and IT organizations. The campaign uses weaponized JAR files delivered via phishing emails impersonating Kyrgyzstan's Ministry of Justice through official-looking PDFs and domains. What's clever: Bloody Wolf leverages NetSupport Manager, a legitimate remote administration tool from 2013, as malware—allowing C2 traffic to blend with normal IT support activity. The JAR payloads execute within Java runtime environments that many EDR solutions trust implicitly. Group-IB researchers found the Uzbekistan phase incorporates geofencing—requests from outside Uzbekistan redirect to legitimate government websites, while requests from within trigger malicious downloads. The group maintains effectiveness through low-cost, commercially available tools weaponized with social engineering.