Bloody Wolf Central Asia phishing campaign targeting Kyrgyzstan and Uzbekistan
Campaign
Summary
Hide ▲
Show ▼
The Bloody Wolf phishing campaign has expanded from Kyrgyzstan to Uzbekistan, widening risk to finance, government, and IT targets across Central Asia. The operation uses official-looking PDFs, malicious domain names, and JAR loaders to deliver NetSupport RAT. It also adds persistence through a scheduled task, a Windows Registry value, and a startup batch script, making the intrusion chain harder to remove.
Related Happenings
NetSupport RAT JAR loader activity targeting Kyrgyzstan and Uzbekistan
Malware Activity
First: 27.11.2025 20:13
Last: 27.11.2025 20:13
Sources 1
How related:
"Those threat actors would impersonate the [Kyrgyzstan's] Ministry of Justice through official looking PDF documents and domain names, which in turn hosted malicious Java Archive (JAR) files designed to deploy the NetSupport RAT," the Singapore-headquartered company said.
About this happening:
The **NetSupport RAT** activity used **malicious JAR loaders** to reach victims in **Kyrgyzstan** and **Uzbekistan**, extending a targeted phishing operation across **Central Asia...
NetSupport RAT JAR loader activity targeting Kyrgyzstan and Uzbekistan
Malware ActivityHow related: "Those threat actors would impersonate the [Kyrgyzstan's] Ministry of Justice through official looking PDF documents and domain names, which in turn hosted malicious Java Archive (JAR) files designed to deploy the NetSupport RAT," the Singapore-headquartered company said.
About this happening: The **NetSupport RAT** activity used **malicious JAR loaders** to reach victims in **Kyrgyzstan** and **Uzbekistan**, extending a targeted phishing operation across **Central Asia...
Bloody Wolf Central Asia spear-phishing campaign
Campaign
First: 27.11.2025 18:00
Last: 27.11.2025 18:00
Sources 1
About this happening:
The **Bloody Wolf** campaign is **expanding across Central Asia**, using **spoofed Ministry of Justice PDFs** and **geofenced infrastructure** to reach government users in **Kyrgy...
Bloody Wolf Central Asia spear-phishing campaign
CampaignAbout this happening: The **Bloody Wolf** campaign is **expanding across Central Asia**, using **spoofed Ministry of Justice PDFs** and **geofenced infrastructure** to reach government users in **Kyrgy...
FoalShell and StallionRAT RAR-delivery activity
Malware Activity
First: 03.10.2025 13:30
Last: 03.10.2025 13:30
Sources 1
About this happening:
A phishing-delivered malware operation is spreading **FoalShell** and **StallionRAT**, enabling **remote command execution** and **data exfiltration** on compromised hosts. The ac...
FoalShell and StallionRAT RAR-delivery activity
Malware ActivityAbout this happening: A phishing-delivered malware operation is spreading **FoalShell** and **StallionRAT**, enabling **remote command execution** and **data exfiltration** on compromised hosts. The ac...
ShadowSilk Central Asia and APAC spear-phishing and exploit campaign
Campaign
First: 27.08.2025 16:47
Last: 27.08.2025 16:47
Sources 1
About this happening:
The **ShadowSilk** campaign is actively hitting **government entities across Central Asia and APAC**, and the current wave matters because it has already reached nearly **three do...
ShadowSilk Central Asia and APAC spear-phishing and exploit campaign
CampaignAbout this happening: The **ShadowSilk** campaign is actively hitting **government entities across Central Asia and APAC**, and the current wave matters because it has already reached nearly **three do...
Timeline
-
27.11.2025 20:13 2 articles · 6mo ago
Bloody Wolf Central Asia phishing campaign disclosed with June-to-October expansion
Initial DisclosureBloody Wolf ran a phishing campaign against Kyrgyzstan since at least June 2025 to deliver NetSupport RAT, impersonating the Kyrgyzstan Ministry of Justice with official-looking PDFs and domain names that hosted malicious JAR files. By October 2025, the activity had expanded to Uzbekistan and was targeting finance, government, and IT sectors; the Uzbekistan phase used geofencing to redirect requests from outside the country to data.egov[.]uz while in-country requests triggered the JAR download.
Show sources
- Bloody Wolf Expands Java-based NetSupport RAT Attacks in Kyrgyzstan and Uzbekistan — thehackernews.com — 27.11.2025 20:13
- Bloody Wolf Expands Java-based NetSupport RAT Attacks in Kyrgyzstan and Uzbekistan — thehackernews.com — 27.11.2025 20:13