Bloody Wolf (Stan Ghouls) Spear-Phishing Campaign Deploying NetSupport RAT in Uzbekistan and Russia

Kaspersky reported that the threat actor Bloody Wolf—tracked by the vendor as Stan Ghouls—is running a spear-phishing campaign primarily targeting organizations in Uzbekistan and Russia, with additional, lower-volume activity observed in other countries. The activity, ongoing since at least 2023, has targeted sectors including manufacturing, finance, and IT, and has also been observed hitting government, logistics, healthcare, and education entities. Reported victim counts for the current wave are on the order of 50+ in Uzbekistan and ~10 in Russia, with the actor assessed as likely financially motivated, though the heavy use of remote-access tooling may also support espionage objectives.

The intrusion chain relies on phishing emails carrying malicious PDF lures (e.g., court/government-themed documents) that embed links leading to a downloader/loader, after which the actor deploys NetSupport RAT (a legitimate remote administration tool) for remote control—representing a shift from prior use of STRRAT. Kaspersky noted the loader’s behavior includes user-deception (fake error messages) and basic execution controls (e.g., limiting repeated installation attempts), while another reported lure uses a social-engineering pretext that victims must install a Java Runtime Environment update, ultimately delivering a malicious JAR—a technique Kaspersky described as a distinctive fingerprint for this actor. Prior related reporting cited phishing activity in Kyrgyzstan distributing similar tooling, indicating a broader regional focus beyond the current Uzbekistan/Russia emphasis.