Bloody Wolf Hackers Deploy NetSupport RAT In Targeted Attacks

Back Cyberpress

Bloody Wolf Hackers Deploy NetSupport RAT In Targeted Attacks

Cyberpress • February 10, 2026

Share: View original

Bloody Wolf hackers, tracked by Kaspersky as the Stan Ghouls, have launched spear- phishing attacks using the NetSupport RAT against firms.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Bloody Wolf Intensifies Spear-Phishing Campaign Using NetSupport RAT The threat actor known as Bloody Wolf has escalated its spear-phishing campaign targeting organizations in Uzbekistan and Russia, utilizing the remote administration tool NetSupport RAT. Active since at least 2023, this campaign employs sophisticated techniques including custom Java-based loaders and multi-layered persistence mechanisms, with infrastructure overlap with IoT malware like the Mirai botnet. The group has also targeted government and private sectors in Kyrgyzstan since June 2025, using weaponized PDF documents that mimic official communications. 6 sources 29

Extracted Entities

APT Groups (2)

Bloody Wolf Hackers Stan Ghouls

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

T1566 - Phishing