Bloody Wolf Hackers Deploy NetSupport RAT In Targeted Attacks

Bloody Wolf hackers, have launched spear-phishing attacks using the NetSupport RAT against firms in Uzbekistan and Russia; the group targets the manufacturing, finance, and IT sectors withcustom Java loaders.

Stan Ghouls has operated since 2023, hitting Russia, Kyrgyzstan, Kazakhstan, and Uzbekistan. Their latest push focused on Uzbekistan, infecting about 50 victims there, 10 in Russia, and a few in Kazakhstan, Turkey, Serbia, and Belarus likely side hits.

Attackers send emails in local languages, such as Uzbek, posing as court notices. A sample email warns of a “court notice” and “retrial application,” with a PDF attachment named E-SUD_705306256_ljro_varaqasi.pdf (MD5: 7556e2f5a8f7d7531f28508f718cb83d).

The PDF tricks users into installing the Java Runtime, then links to a malicious JAR file (MD5: 95db93454ec1d581311c832122d21b20) hosted on domains like mysoliq-uz[.]com or my-xb[.]com.

This loader shows a fake error: “This application cannot be run in your OS.” It limits installs to fewer than 3 attempts per machine, then downloads 20 NetSupport RAT files, such as client32.exe, PCICHEK.DLL, and client32.ini, from backup domains.

Once downloaded, the loader creates run.bat to launch the RAT, checks for client32.exe, and sets persistence three ways: a Startup folder script (SoliqUZ_Run.bat), registry key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run), and scheduled task (schtasks /TN malicious /TR run.bat /SC ONLOGON).

This gives attackers full remote control, likely for stealing money from banks or spying. Previously, they used STRRAT; now they abuse legitimate NetSupport tools, refreshing domains often over 35 linked so far.

Victims, Links, and Defense

Victims span manufacturing, finance, IT, government, logistics, health, and schools over 60 in total, indicating significant resources for manual control. Kaspersky links it to Bloody Wolf via matching Java code snippets, identical decoy PDFs, and rare Java loaders.

According to Securelist, a past domain (hgame33[.]com) hosted Mirai IoT botnet files, such as Morte. arm and morte.x86, first seen in May 2025. It might mean Stan Ghouls eyes IoT, or shared servers low confidence.

Defend by scanning PDFs, blocking Java from untrusted links, watching for NetSupport files, autorun changes, and odd tasks. Update infrastructure detection; use EDR tools. Kaspersky products block all stages.​

This well-resourced group focuses on phishing but continues to evolve its tools, stressing vigilance in local languages across CIS regions.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.