Bloody Wolf Targets Uzbekistan, Russia Using NetSupport RAT in Spear-Phishing Campaign

Executive summary: The report describes an active spear‑phishing campaign by the actor known as Bloody Wolf (Kaspersky: Stan Ghouls) that has deployed NetSupport RAT via malicious PDFs to compromise targets in Uzbekistan, Russia and neighboring states, with roughly 60+ victims observed and additional infrastructure linked to Mirai IoT payloads. The document also contextualizes this activity alongside other threat clusters (ExCobalt, Punishing Owl, Vortex Werewolf), detailing their tools and TTPs including loaders, persistence mechanisms, credential theft and kernel rootkits.