Bloody Wolf Hackers Deploy NetSupport RAT via Fake Government PDFs

First seen 1 Dec 2025, 18:41 UTC • •42

Article Content

1 / 4

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

The Bloody Wolf hacking group has been identified using fake government emails and weaponized PDFs to deploy the NetSupport Remote Access Trojan (RAT). This advanced persistent threat (APT) targets various organizations by masquerading as legitimate government communications. The malicious PDFs are designed to compromise systems and facilitate unauthorized access.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 229d ago How this analysis works

Threat Graph

6 entities, 8 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (2)

Bloody Wolf
Bloody Wolf Hackers

Technique (3)

Malware
Phishing
Trojan

Malware (1)

NetSupport RAT

Relationships

Bloody Wolf uses NetSupport RAT
Bloody Wolf Hackers uses NetSupport RAT
Bloody Wolf uses Malware
Bloody Wolf uses Phishing
Bloody Wolf uses Trojan
Bloody Wolf Hackers uses Malware
Bloody Wolf Hackers uses Phishing
Bloody Wolf Hackers uses Trojan

Following this threat?

Track Bloody Wolf and NetSupport RAT in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Bloody Wolf Hackers Deploy NetSupport RAT via Fake Government PDFs

Article Content

More articles in this cluster (3)

Threat Graph

Following this threat?

Extracted Entities (6)

APT Groups (2)

Attack Types (3)

Malware (1)