Bloody Wolf Expands Java-based NetSupport RAT Attacks in Kyrgyzstan and Uzbekistan

The threat actor Bloody Wolf has been conducting cyber attack campaigns targeting Kyrgyzstan since at least June 2025, delivering NetSupport RAT malware. The campaign has expanded as of October 2025 to also target Uzbekistan. The attacks utilize Java-based NetSupport RAT to compromise systems in these Central Asian countries. Research was conducted by Group-IB in collaboration with Ukuk, a state enterprise. This represents an ongoing active campaign with geographic expansion indicating escalating threat activity.