Bloody Wolf APT Expands to Central Asia, Deploys NetSupport RAT via Custom Java Droppers and Geo-Fencing

The article discusses the expansion of the advanced persistent threat (APT) group known as Bloody Wolf into Central Asia, specifically targeting Kyrgyzstan and Uzbekistan. Active since late 2023, the group has shifted from using common malware to deploying the legitimate remote administration tool NetSupport RAT, which allows them to blend in with normal IT activities and evade detection. Their attack strategy involves spear-phishing emails with official-looking PDF attachments that lead to malicious downloads.

The group employs a custom Java Archive (JAR) generator to create malware that establishes persistence on victim machines through various methods. Organizations in Central Asia are advised to remain vigilant against these evolving threats.