Tuesday, February 10, 2026

cyber attacks 2026, cyber threat news, enterprise security, NetSupport RAT, remote access trojan, spear-phishing attack

Coordinated Spear-Phishing Campaign Uses NetSupport RAT to Target Organizations in Central Asia and Russia

NetSupport RAT Spear-Phishing Campaign Targets Central Asia and Russia

Cybersecurity researchers have identified a sustained and highly targeted cyber campaign affecting organizations across Central Asia and Russia, where attackers are using spear-phishing emails to distribute NetSupport RAT, a legitimate remote administration tool repurposed for malicious access.

The campaign has been attributed to a threat actor commonly referred to as Bloody Wolf, a group that analysts say has been active since at least 2023. The operation demonstrates a clear focus on sectors that handle sensitive operational or financial data, including manufacturing, financial services, information technology, and various public-sector entities.

Concentration of Infections Across Multiple Countries

According to available intelligence, the highest number of confirmed infections has been recorded in Uzbekistan, where dozens of systems were compromised. Russia has also been impacted, with a smaller but significant number of infected devices confirmed. Additional cases have been identified in Kazakhstan, Turkey, Serbia, and Belarus, indicating a campaign that extends beyond a single geographic focus.

Security teams have also observed attempted intrusions into government institutions, logistics firms, healthcare organizations, and educational establishments. While not all attempts resulted in successful infections, the targeting patterns suggest careful reconnaissance and selection of victims rather than random mass distribution.

Researchers assessing the campaign believe the attackers are primarily motivated by financial objectives, particularly given the repeated targeting of financial entities. However, the nature of the tools involved allows for extensive monitoring and control of infected systems, which leaves open the possibility of intelligence gathering or long-term surveillance.

Strategic Shift Toward Legitimate Remote Tools

One of the defining characteristics of this campaign is the deliberate misuse of NetSupport, a commercially available remote management tool widely used by IT administrators for legitimate support purposes. By deploying trusted software rather than custom malware, the attackers significantly reduce the likelihood of triggering traditional security alerts.

This approach marks a departure from the group’s earlier activity, which relied more heavily on conventional remote access trojans. The shift highlights a broader trend in modern cyber operations, where threat actors increasingly blend malicious activity with legitimate software to evade detection and extend dwell time within compromised environments.

Security analysts note that abusing legitimate tools allows attackers to operate in plain sight, often appearing indistinguishable from authorized administrative activity. This complicates both detection and forensic analysis, particularly in organizations without advanced monitoring capabilities.

Phishing as the Primary Entry Vector

The infection process begins with carefully crafted phishing emails sent directly to targeted individuals. These emails often appear relevant to the recipient’s role and include PDF attachments designed to look authentic and business-related.

Within these PDF files are embedded links that redirect users to a remote server hosting a malicious loader. Once executed, the loader initiates a multi-step process intended to quietly establish control over the system while minimizing suspicion.

Key behaviors observed during this stage include the display of fake system error messages, which give the impression that the file failed to run properly. This tactic reduces the likelihood that victims will report the incident or attempt further investigation.

The loader also limits the number of installation attempts on a single system. If the predefined threshold is exceeded, execution is halted, and the user is shown an error message indicating that the operation cannot continue. This restriction is believed to be an anti-analysis measure designed to avoid automated detection environments.

Once these checks are complete, the loader retrieves NetSupport RAT from an external server and launches it on the victim’s machine.

Establishing Long-Term Access

After deployment, the attackers focus on maintaining persistent access to the compromised system. To achieve this, multiple persistence mechanisms are implemented simultaneously.

These include placing scripts in startup directories, adding autorun entries to the system registry, and creating scheduled tasks that ensure the remote access tool is launched automatically during system startup. This layered persistence strategy increases the likelihood that access will survive system reboots and basic cleanup attempts.

The end result is a system that can be remotely controlled at will, allowing attackers to monitor activity, transfer files, execute commands, and potentially move laterally within the broader network.

Possible Expansion into IoT Threats

During infrastructure analysis linked to the campaign, researchers also identified Mirai-based payloads hosted on servers associated with the attackers. While no direct link has yet been established between these payloads and the Windows-focused campaign, their presence raises concerns about a potential expansion into IoT-focused attacks.

Mirai variants are commonly used to compromise network-connected devices such as routers, cameras, and industrial equipment. If integrated into the same operational framework, this could significantly broaden the threat actor’s reach and impact.

Broader Surge in Regional Cyber Activity

The Bloody Wolf campaign is unfolding against a backdrop of heightened cyber activity targeting organizations in Russia and neighboring regions. Multiple threat groups have been observed exploiting exposed services, leveraging stolen credentials obtained through third-party contractors, and deploying a combination of backdoors, ransomware, and credential-stealing tools.

In several cases, attackers have targeted messaging platforms and webmail services in an effort to harvest authentication data and internal communications. These techniques enable deeper penetration into corporate environments and support long-term operational goals.

Security researchers note that many of these campaigns share common traits, including reliance on phishing for initial access, the use of legitimate administrative tools, and an emphasis on persistence rather than immediate disruption.

Emerging Threat Actors Add to Complexity

In parallel, new threat clusters have emerged with varying objectives. Some groups appear focused on data theft and public disclosure, while others prioritize persistent access and covert operations. In several cases, stolen data has surfaced on underground forums or dark web platforms, amplifying the operational and reputational impact on affected organizations.

This evolving threat landscape highlights the increasing sophistication of attackers operating in the region, as well as their willingness to adapt tactics in response to improved defensive measures.

Techfacto Global Services Perspective

The continued abuse of phishing techniques and legitimate remote administration tools underscores a critical reality: modern cyber threats are no longer defined solely by malware, but by deception, persistence, and misuse of trusted technologies.

Techfacto Global Services helps organizations address these challenges by strengthening their cybersecurity foundations through proactive risk assessments, phishing resilience strategies, endpoint and network security solutions, and incident response preparedness. By focusing on early detection, behavioral monitoring, and secure system architecture, Techfacto Global Services supports businesses in reducing exposure to targeted attacks and maintaining long-term digital resilience.

As threat actors continue to refine their methods, a security-first approach remains essential for organizations operating in today’s increasingly complex cyber environment.