Bloody Wolf Expands Cyberattacks in Kyrgyzstan and Uzbekistan

Bloody Wolf, a threat actor, has been behind a string of cyberattacks. They started hitting Kyrgyzstan back in June 2025, mainly to sneak in the NetSupport RAT.

By October 2025, Group-IB and Ukuk reported that these attacks had moved into Uzbekistan, too. The main targets? Finance, government, and IT organizations.

Group-IB analysts picked up on this shift in early October. Bloody Wolf didn’t switch up their tactics – they stuck with the same entry methods and infrastructure they used in Kyrgyzstan.

A few things stand out:

Bloody Wolf is still active in 2025 and now reaching farther into Central Asia.

They love pretending to be government agencies, especially the Ministry of Justice, to trick people.

No direct government link has turned up yet. Still, Bloody Wolf puts together lure PDFs in the local languages to sound convincing – though they mostly stick to Russian.

And when it comes to spreading their malware, they use their own JAR generator to make fresh samples.

Activity Spreads Beyond Initial Targets

This week, researchers found out the group’s campaign didn’t just hit Kyrgyzstan; it started there back in June 2025, but by October, they’d already expanded into Uzbekistan too.

Here’s how they pull it off: The attackers pretend to be the Ministry of Justice. They send official-looking PDFs, set up fake websites, and tell people they need to install Java to read legal documents. The messages are short, sharp, and convincing, just enough to pass as the real thing.

Investigators cracked the case by digging through threat intelligence and really picking apart the group’s infrastructure. In Uzbekistan, Bloody Wolf used a slick move: geofencing. If someone outside the country tries to visit, they get sent to the real government website. But if you’re local, you get handed a nasty JAR file instead.

How the Infection Chain Works

When someone opens the downloaded JAR file, the loader first extracts additional components and finally installs NetSupport RAT to provide remote control. These loaders are built solely with Java 8, contain a single class, and are straightforward. They are small, yet incredibly efficient, managing many tasks on their own.

These loaders also have a launch limit counter, set to three. This counter is stored in the user’s profile directory, meaning the malware will not run more than three times, avoiding user suspicion.

The analyst explained that the group uses a custom JAR generator. This allows them to create large-scale samples, each with a different download path, registry entry, and error message.

They previously used STRRAT, but have now switched to the older 2013 version of NetSupport Manager, possibly because it comes with a publicly available license.

The report revealed that this combination of social engineering and low-cost tools is helping Bloody Wolf remain active in Central Asia.

Group-IB wrote, “This combination of social engineering and simple tools allows Bloody Wolf to remain effective even at a low profile. When these individuals adopt legit remote-administration software, rather than traditional malware, they attempt to evade detection and hide within normal IT activity.”

“The adaptability and tenacity of this group suggest that organizations in Central Asia will need to remain vigilant against spear-phishing and changing infection patterns.”

Frequently Asked Questions (FAQs)