Bloody Wolf Hackers Use Fake Government PDFs to Deliver NetSupport RAT

Bloody Wolf, an advanced persistent threat (APT) group active since late 2023, has expanded its cyber operations across Central Asia, now targeting Kyrgyzstan and Uzbekistan with sophisticated spear-phishing campaigns that impersonate government ministries.

A joint investigation by Group-IB and Kyrgyzstan’s UKUK has uncovered the group’s latest tactics, which weaponize legitimate remote administration software to compromise victims while evading traditional security defenses.

The threat actors, who previously targeted Kazakhstan and Russia using commercial STRRAT malware before transitioning to NetSupport RAT, have been conducting operations in Kyrgyzstan since at least June 2025.

By early October 2025, Group-IB analysts observed that Bloody Wolf extended its activities to Uzbekistan, employing identical initial access techniques and infrastructure previously seen in the Kyrgyz campaign.

The group’s modus operandi involves impersonating the Ministry of Justice through official-looking PDF documents and domain names.

These deceptive materials host malicious Java Archive (JAR) files that deploy the NetSupport RAT a legitimate remote administration tool repurposed for malicious activity.

Infection Chain and Technical Tactics

The attack begins with a spear-phishing email containing a PDF attachment that mimics official government correspondence. The document instructs victims to click embedded links labeled as “case materials,” which initiates the infection chain.

A notable social engineering element involves instructing recipients to install the Java runtime from the official website, purportedly required to view the documents.

In the Uzbekistan campaign, the delivery infrastructure incorporated geo-fencing capabilities. Requests originating from outside Uzbekistan were redirected to the legitimate data.egov.uz website, while in-country requests triggered automatic downloads of malicious Java Archives from embedded URLs.

This technique helps the group avoid detection and analysis by international security researchers.

Once executed, the malware displays a fake error message while downloading additional NetSupport RAT components from attacker-controlled domains in the background.

The JAR files are intentionally small in size, and using Java likely serves as an evasion technique against antivirus detection.

Group-IB’s investigation revealed that Bloody Wolf employs a custom-made JAR generator to create numerous samples for distribution.

Each JAR contains a single Java class without obfuscation and was built using Java 8, released in 2014.

The files download NetSupport Manager binaries over HTTP, add the program to autostart, and schedule tasks to run the NetSupport binary.

To maintain persistence, the malware establishes three simultaneous autostart mechanisms: dropping a batch file into the Windows Startup folder, adding a registry value to the Run key, and creating a scheduled task to execute on logon.

The group uses an outdated 2013 version of NetSupport Manager with various licenses likely obtained from the internet.

Implications and Recommendations

Bloody Wolf’s operations demonstrate how low-cost, commercially available tools can be weaponized into sophisticated, regionally targeted cyber campaigns.

By exploiting trust in government institutions and leveraging simple JAR-based loaders, the group maintains effectiveness while keeping a low operational profile.

The shift from traditional malware to legitimate remote-administration software indicates an evolving tactical approach aimed at evading detection and blending into regular IT activity.

Organizations across Central Asia, particularly government entities and enterprises, should remain vigilant against continued spear-phishing activity and implement robust email security controls, endpoint detection capabilities, and user awareness training to mitigate this persistent threat.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.