{"id":211646,"date":"2026-02-09T05:58:00","date_gmt":"2026-02-09T10:58:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/02\/09\/bloody-wolf-targets-uzbekistan-russia-using-netsupport-rat-in-spear-phishing-campaign\/"},"modified":"2026-02-09T12:55:09","modified_gmt":"2026-02-09T17:55:09","slug":"bloody-wolf-targets-uzbekistan-russia-using-netsupport-rat-in-spear-phishing-campaign","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/02\/09\/bloody-wolf-targets-uzbekistan-russia-using-netsupport-rat-in-spear-phishing-campaign\/","title":{"rendered":"Bloody Wolf Targets Uzbekistan, Russia Using NetSupport RAT in Spear-Phishing Campaign"},"content":{"rendered":"

Bloody Wolf Targets Uzbekistan, Russia Using NetSupport RAT in Spear-Phishing Campaign<\/a><\/p>\n

https:\/\/thehackernews.com\/2026\/02\/bloody-wolf-targets-uzbekistan-russia.html<\/a><\/p>\n

Publish Date: 2026-02-09 05:58:00<\/a><\/p>\n

Source Domain: thehackernews.com<\/a><\/p>\n

\ue804Ravie Lakshmanan<\/span>\ue802Feb 09, 2026<\/span><\/span>Threat Intelligence \/ Cyber Espionage<\/span><\/p>\n

The threat actor known as Bloody Wolf<\/strong> has been linked to a campaign targeting Uzbekistan and Russia to infect systems with a remote access trojan known as NetSupport RAT.<\/p>\n

Cybersecurity vendor Kaspersky is tracking the activity under the moniker Stan Ghouls. The threat actor is known to be active since at least 2023, orchestrating spear-phishing attacks against manufacturing, finance, and IT sectors in Russia, Kyrgyzstan, Kazakhstan, and Uzbekistan.<\/p>\n

The campaign is estimated to have claimed about 50 victims in Uzbekistan, with 10 devices in Russia also impacted. Other infections have been identified to a lesser degree in Kazakhstan, Turkey, Serbia, and Belarus. Infection attempts have also been recorded on devices within government organizations, logistics companies, medical facilities, and educational institutions.<\/p>\n

“Given Stan Ghouls’ targeting of financial institutions, we believe their primary motive is financial gain,” Kaspersky noted. “That said, their heavy use of RATs may also hint at cyber espionage.”<\/p>\n

The misuse of NetSupport, a legitimate remote administration tool, is a departure for the threat actor, which previously leveraged STRRAT (aka Strigoi Master) in its attacks. In November 2025, Group-IB documented phishing attacks aimed at entities in Kyrgyzstan to distribute the tool.<\/p>\n

The attack chains are fairly straightforward in that phishing emails loaded with malicious PDF attachments are used as a launchpad to trigger the infection. The PDF documents embed links that, when clicked, lead to the download of a malicious loader that handles multiple tasks –<\/p>\n