The Ministry of Just Kidding: How Bloody Wolf Turns PDFs into Remote Control

December 2, 2025

And the wire is attached to the PDF - love it!

Synopsis

The analysis indicates that Bloody Wolf is a highly capable APT using justice-themed, localized spear-phishing to persuade users to install Java and execute custom JAR loaders that silently deploy and persist a legitimate NetSupport RAT, giving the actor covert, long-term remote access to justice-related and government-adjacent endpoints across Central Asia. Strategically, this supports treating social-engineering–driven remote-access compromise as a persistent APT risk with moderate-to-high threat event frequency, requiring board-level attention to email security, remote administration policies, and FAIR-informed risk thresholds. Operationally, it pushes security teams to strengthen monitoring of Java and JAR execution, persistence mechanisms, and NetSupport usage, and to tighten governance over software installation and government-branded communications, while tactically driving more precise detections for “case materials” lures, JAR-based loaders, and NetSupport-related artifacts. The FAIR breakdown (elevated susceptibility, estimated LEF around 2–3 events per year, and loss magnitude ranges that scale from tens of thousands to low seven figures for primary and secondary losses) suggests that current controls leave meaningful residual exposure that can produce repeated, non-trivial incidents rather than rare outliers. For financial resilience, this means organizations should anticipate recurring response and recovery costs, plus the potential for higher-impact events involving legal or governmental data, and justify investments in monitoring, training, and control hardening as a way to reduce expected annual loss rather than react only after a major compromise.

Evaluated Source, Context, and Claim

Artifact Title

Bloody Wolf: A Blunt Crowbar Threat To Justice

https://www.group-ib.com/blog/bloody-wolf/

Source Type

Threat intelligence blog post (vendor web/blog article)

Publication Date: November 26, 2025

Credibility Assessment

Group-IB is a known cybersecurity vendor producing detailed technical reporting on threat actors, which supports the general reliability of the technical observations in this blog. As with any single vendor source, key claims are best treated as credible but ideally corroborated with additional independent reporting where possible.

General Claim

The information claims that the APT group “Bloody Wolf” is actively expanding spear-phishing campaigns across Central Asia by impersonating Ministries of Justice and using custom JAR loaders to deploy the legitimate NetSupport RAT for persistent remote access and low-profile operations.

Narrative Reconstruction

The OSINT describes an advanced persistent threat group known as Bloody Wolf, active since late 2023, conducting targeted spear-phishing campaigns across multiple Central Asian countries by impersonating Ministries of Justice and other government entities. The actor, whose state affiliation remains unconfirmed, uses localized PDF lures and domains that resemble official justice ministry infrastructure to convince recipients to click embedded links labeled as “case materials,” then instructs them to install Java and execute malicious Java Archive (JAR) files. Once executed, these lightweight, custom-generated JAR loaders download and configure an older version of the legitimate NetSupport Manager remote administration tool, establish persistence via startup folders, registry run keys, and scheduled tasks, and display fake error messages to distract the user while remote access is established. The primary assets targeted appear to be user endpoints and associated credentials within justice-related and government-adjacent organizations in Kyrgyzstan, Uzbekistan, and the broader Central Asian region, with plausible extension to corporate and institutional environments that interact with these agencies. Operationally, the campaign aims to gain and maintain covert remote control over victim systems, blend into normal IT activity by abusing legitimate software, and sustain a long-term foothold for follow-on activities such as surveillance, data access, or further lateral movement.

Risk Scenario

Risk Scenario

A threat actor conducts a successful spear-phishing campaign that convinces an employee to execute a malicious JAR file impersonating official government case materials, enabling the attacker to install a legitimate remote-administration tool (NetSupport RAT) for persistent unauthorized access to an organization’s workstation. This results in the loss of confidentiality, integrity, or availability of sensitive data and systems accessible from that endpoint, including potential surveillance, data extraction, unauthorized account use, or further lateral movement within the environment.

Threat

Bloody Wolf, an APT group active since late 2023, runs ongoing spear-phishing campaigns across Central Asia, impersonating Ministries of Justice and crafting localized lures in regional languages (with frequent use of Russian) to increase the likelihood that targeted recipients will execute malicious payloads and allow remote access.

Method

The group sends spear-phishing emails with PDF attachments that mimic official justice ministry correspondence, embedding links labeled as case materials that direct victims to malicious infrastructure; victims are instructed to install Java and run JAR files, which then download and configure an outdated but legitimate NetSupport Manager RAT, establish persistence through startup folders, registry run keys, and scheduled tasks, and display fake error messages to hide these activities while enabling ongoing remote control.

Asset

Primary assets at risk are user endpoints, user accounts, and the data and system access associated with justice-related and government-adjacent organizations in Kyrgyzstan, Uzbekistan, and the wider Central Asian region, including documents, case-related information, and any connected internal systems reachable from compromised workstations.

Impact

If the scenario materializes, the organization may experience unauthorized remote access to sensitive systems, exposure or silent collection of legal or government data, loss of confidentiality and integrity of case-related information, and the establishment of a persistent foothold that could support further internal compromise, data exfiltration, or misuse of official systems over time, with associated legal, operational, and reputational consequences.

Evidentiary Basis for Synopsis and Recommendations

Supporting observations from the analysis help clarify how the threat landscape, control environment, and organizational behaviors interact to shape overall risk exposure. These insights provide the foundation for identifying where controls perform well, where gaps or weaknesses create unnecessary vulnerability, and how attacker methods intersect with real-world operational conditions. Building on these findings, the recommendations that follow focus on strengthening resilience, improving decision-making, and guiding readers toward practical steps that enhance both security posture and risk-informed governance.

FAIR Breakdown

Threat Event Frequency (TEF)

Because the information describes an active, ongoing, regionally scaled spear-phishing campaign across multiple Central Asian countries, TEF must be inferred from observed expansion, persistence, and delivery method. TEF is likely moderate-to-high because the actor distributes repeated, localized phishing waves and continuously generates new JAR samples for distribution.

Contact Frequency (CF)

The information explicitly states a surge in spear-phishing beginning in June 2025, targeting Kyrgyzstan, later expanding into Uzbekistan, and reusing similar infrastructure across the region. This indicates moderate-to-high CF, as spear-phishing is deliberately distributed at scale to multiple government-adjacent sectors, not isolated individuals. Sector targeting is specific—government ministries, legal institutions, and potentially broader public-sector ecosystems—suggesting concentrated but recurring contact attempts.

Probably of Action (PoA)

Motivation appears high, as the actor maintains multi-month campaigns, adapts lures to local languages, and continues shifting infrastructure across borders to sustain access. Campaign aggressiveness is supported by repeated waves, custom JAR generation, and persistent impersonation of justice ministries, all of which indicate a high PoA once contact is made.

Threat Capability (TCap)

TCap is high, as Bloody Wolf demonstrates multi-stage social engineering, persistent tooling development, localized lure tailoring, and reliable system compromise using NetSupport RAT.

Exploit sophistication: Moderate—no advanced zero-days, but precise spear-phishing, geo-fencing, and a tailored JAR loader chain demonstrate meaningful technical planning.

Bypass ability: High—use of legitimate NetSupport RAT to blend into normal activity, fake error messages, and multi-layer persistence bypasses basic detection and user awareness.

Tooling maturity: High—custom JAR generators, recurring build templates, consistent infection chains, and multiple JAR variations indicate mature internal tooling.

Campaign success rate: Likely moderate-to-high—spear-phishing plus legitimate RAT deployment historically succeeds in a substantial portion of targeted victims.

Attack path sophistication: High—multi-stage lure leading to a Java installation prompt, followed by JAR execution, then a staged download, then RAT installation, and finally three-layer persistence.

Cost to run attack: Low-to-moderate—Java loaders and NetSupport RAT are inexpensive; labor is mostly in pretexting and lure generation, making the campaign affordable for a persistent actor.

Control Strength (CS)

Overall CS is moderate at best, considering the heavy reliance on human-layer deception and the ability of the attacker to bypass common endpoint safeguards.

Resistive Strength (RS)Effectiveness of preventive/detective controls:

• Preventive controls are weakened due to reliance on user judgment against official-looking PDFs and domains.

• Detective controls may identify NetSupport RAT later in the chain but are less effective against older versions and varied download paths.

• Social engineering significantly reduces the effectiveness of human-layer defenses.

Control Failure Rate

Control failure is likely moderate-to-high because:

• Users are instructed to install Java and run JAR files, overriding default security expectations.

• PDFs mimic justice ministries, creating high trust conditions.

• Geo-fenced delivery ensures that only true targets receive payloads, bypassing many global scanning and detection systems.

Susceptibility

Given high TCap and only moderate CS, susceptibility is estimated at 60–75 percent, reflecting a substantial likelihood that a contacted asset will be harmed.

Probability the asset will be harmed is influenced by:

Exploitability: High (70–85 percent) because the attack requires user execution rather than technical exploitation.

Attack surface: Government endpoints and justice-related sectors represent a large and predictable user base for these lures (50–70 percent exposure).

Exposure conditions: High trust in government-themed documents elevates susceptibility (60–80 percent).

Patch status: Not a major mitigating factor (0–10 percent impact) because the attack bypasses patchable vulnerabilities.

Numerical Frequencies and Magnitudes

All values relating to actual dollar amounts are for example/speculative purposes only. Organizations would need to take into account their own asset values, control strength, telemetry, etc., and adjust numbers accordingly.

Loss Event Frequency (LEF)

2.6/year (estimated)

• Justification: The campaign is active across multiple countries with recurring spear-phishing waves, leading to a moderate number of annual contact attempts that can realistically result in compromise.

Vulnerability (probability of harm per contact): .65

• Justification: The attack hinges on convincing users to execute JAR files via trusted-looking government lures, producing a relatively high probability of success once contact occurs.

Secondary Loss Event Frequency

1/year (estimated)

• Justification: While not every compromise results in deeper intrusion, RAT-based access frequently enables follow-on activity, making secondary events reasonably likely in a subset of primary incidents.

Loss Magnitude

Estimated range:

• Min: $10,000

• Most Likely: $90,000

  Maximum: $400,000

Justification:

• Minimum includes localized workstation cleanup and investigation. Most likely includes remote-access abuse, internal system review, credential resets, and IR labor. Maximum reflects access to sensitive government/legal data, multi-system compromise, or prolonged covert surveillance.

Secondary Loss Magnitude (SLM)

Estimated range:

• Min: $50,000

• Most Likely: $250,000

• Maximum: $1,200,000

Justification:

• Secondary losses could include data exposure, misuse of internal credentials, unauthorized access to sensitive case materials, broader operational disruption, or regulatory consequences depending on the environment.

Mapping, Controls, and Modeling

MITRE ATT&CK Mapping

Resource Development

T1583.001 – Acquire Infrastructure: Domains

Reference: “Impersonate the country’s Ministry of Justice through… domain names, which in turn hosted malicious Java Archive (JAR) files.”

T1587.001 – Develop Malware: Malware

Reference: “Bloody Wolf uses a custom-made JAR generator to create numerous samples for further distribution.”

Initial Access

T1566.002 – Spearphishing Link

Reference: “The attack begins with a spear-phishing email containing a PDF attachment… instructing victims to open embedded malicious links labeled ‘case materials’.”

T1566.001 – Spearphishing Attachment

Reference: “A spear-phishing email containing a PDF attachment… impersonates the Ministry of Justice.”

Execution

T1204.002 – User Execution: Malicious File

Reference: “After the victim runs the downloaded Java archive (JAR)… the payload downloads additional components.”

T1059.005 – Command and Scripting Interpreter: Visual Basic/Java

Reference: “Each JAR contains a single Java class… built with Java 8.”

Persistence

T1547.001 – Registry Run Keys / Startup Folder

Reference: “It adds a registry value… HKCU\Software\Microsoft\Windows\CurrentVersion\Run.”

T1547.009 – Shortcut Modification / Startup Items

Reference: “It drops a .bat file into %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup.”

T1053.005 – Scheduled Task

Reference: “It creates a scheduled task by running: schtasks /TN … /SC ONLOGON.”

Defensive Evasion

T1036 – Masquerading

Reference: “PDF impersonates the Ministry of Justice… crafted in local languages to increase credibility.”

T1070 – Indicator Removal / Obfuscation (Light)

Reference: “The createTempFiles function doesn’t do anything… likely left unfinished or used for debugging purposes.” (This is minimal but reflects intentional simplicity to avoid detection; no obfuscation is claimed, so no additional mappings added.)

Command and Control

T1219 – Remote Access Software

Reference: “Ultimately deploys NetSupport RAT for remote control and post-compromise activity.”

T1105 – Ingress Tool Transfer

Reference: “The JAR payload downloads additional components… downloads NetSupport Manager binaries from an embedded URL.”

NIST 800-53 Affected Controls

AT-2(3) — Literacy Training and Awareness | Social Engineering and Mining

Reference: “The attack begins with a spear-phishing email… impersonates the Ministry of Justice… instructs victims to open embedded malicious links.”Explanation: The activity exploits user trust in government agencies, directly undermining awareness training intended to prevent phishing and fraudulent communications.

CM-7 — Least Functionality

Reference: “The lure instructs recipients… to install Java runtime from the official website… After the victim runs the downloaded JAR, the payload downloads additional components.”Explanation: Users installing unneeded runtime components expands the functional attack surface in violation of least-functionality principles.

CM-6 — Configuration Settings

Reference: “JAR files… built with Java 8 (2014)… using legitimate NetSupport Manager binaries from 2013.”Explanation: The use of outdated software components and exploitation of environments running legacy Java runtimes suggests weak configuration baselines.

SI-3 — Malicious Code Protection

Reference: “Using Java is probably an easy way to avoid antivirus detection… numerous JAR samples created for further distribution.”Explanation: The campaign intentionally evades signature-based defenses, exploiting weaknesses in malware scanning and runtime monitoring.

SI-4 — System Monitoring

Reference: “After execution, the malware displays a fake error message while downloading additional NetSupport RAT components from the attacker-controlled domain.”Explanation: The covert download and execution of remote binaries demonstrates a gap in outbound traffic monitoring and behavioral detection.

SC-7 — Boundary Protection

Reference: “Delivery infrastructure was geo-fenced… requests within the country triggered automatic download of a malicious Java Archive.”Explanation: Geo-fencing evades non-local analysis systems, highlighting boundary-control gaps in filtering outbound and inbound resource requests.

AC-6 — Least Privilege

Reference: “It creates a scheduled task… adds registry value… adds program to autorun.”Explanation: The malware successfully modifies system-level autorun and scheduled-task configurations, indicating insufficient restrictions on user-level ability to modify persistence mechanisms.

SI-7 — Software, Firmware, and Information Integrity

Reference: “Malicious Java Archive (JAR) files designed to deploy the NetSupport RAT… created using a custom-made JAR generator.”Explanation: Users executing unverified JARs without integrity checks demonstrates a control gap related to software validation and integrity verification.

MP-7 — Media Use Restrictions (Executable Files)

Reference: “After the victim runs the downloaded Java archive (JAR)…”Explanation: Execution of downloaded executable content demonstrates ineffective restrictions on executing untrusted or non-whitelisted code.

Threat Model

Model from artifact reference

Monitoring, Hunting, Response, and Reversing

Monitoring

Monitoring should prioritize telemetry from email security gateways, endpoint agents, DNS and web proxies, and Windows host logging, with supplemental identity and VPN logs to confirm which users actually received and executed the justice-ministry lures. Email logging must capture full details on spear-phishing messages with PDF attachments and embedded links, including sender, subject, URLs, headers, and attachment hashes, while web/DNS logs need visibility into requests to domains masquerading as justice ministries and to attacker-controlled infrastructure that serves JAR payloads and NetSupport components, including geo-fenced behavior where only traffic from specific countries receives malicious content. Endpoint logging should record process creation, command-line parameters, Java runtime execution, JAR launches, .bat file creation in startup folders, registry modifications under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, and scheduled task creation that references NetSupport binaries. Key indicators to prioritize include users being instructed to install Java, execution of previously unseen JAR files, outbound HTTP traffic pulling NetSupport Manager from non-standard URLs, and fake error dialogs appearing shortly after JAR execution. Monitoring gaps likely include insufficient inspection of Java-based execution chains, lack of baselining for NetSupport usage, and limited country-aware HTTP/DNS analytics that would highlight geo-fenced behavior. Correlation logic should tie together a justice-themed spear-phish, click-through on “case materials” links, Java installation or execution, creation of persistence artifacts (startup .bat, Run key, scheduled task), and subsequent sustained NetSupport network sessions, with alert thresholds tuned to minimize noise by focusing on endpoints and accounts that do not normally use Java or remote-administration tools. Dashboards and metrics should highlight volume and trends of justice-themed phishing, new JAR executions, NetSupport detections, and persistence events over time, and monitoring validation should use safely detonated or simulated JAR loaders and test NetSupport deployments to confirm that telemetry, correlation, and alerting behave as expected.

Hunting

Hunting should start from hypotheses such as “Users in justice-related or government-adjacent business units have been targeted with justice-ministry PDFs containing embedded ‘case materials’ links” and “NetSupport RAT has been silently installed via Java-based loaders on endpoints that do not normally use remote-administration tools.” Telemetry for hunts should include mailbox and email-gateway logs for messages spoofing or referencing Ministries of Justice, EDR data for Java and JAR execution patterns, process-tree relationships between Java, temporary files, and NetSupport binaries, Windows event logs for Run key changes and scheduled tasks, and network/DNS logs for suspicious downloads of JAR files and legacy NetSupport binaries from non-corporate domains. Detection logic can focus on justice-themed PDFs with embedded URLs, uncommon Java execution by non-developer users, small JAR files downloading executable content over HTTP, creation of startup .bat files in user profile paths, new Run keys pointing to NetSupport executables, and scheduled tasks configured to launch the same. Noise-to-signal considerations require filtering for environments where legitimate NetSupport use is common and excluding known-good Java-heavy workloads; hunts should be scoped to departments that interact with justice entities or operate in Kyrgyzstan, Uzbekistan, or similar regions to keep results focused and actionable.

Response

Response should rely on detailed email, web proxy, DNS, and EDR logs to reconstruct when a user received a justice-themed spear-phish, accessed the “case materials” link, installed Java, and executed the JAR responsible for downloading NetSupport. Key artifacts include the malicious PDFs and JARs, browser history showing access to spoofed ministry domains, Java execution traces, NetSupport binaries placed in user directories, associated startup .bat files, Run-key entries, scheduled tasks, and any visible fake error dialogs. Because anti-forensic behavior is minimal and mainly limited to distraction through error messages, reconstruction depends on file system artifacts, registry and task-scheduler changes, and network-flow evidence. DFIR teams should map each stage of the compromise chain to FAIR loss drivers, factoring in RAT dwell time, account access breadth, and any confirmed data access or movement. Containment will focus on isolating affected systems, removing NetSupport and persistence artifacts, resetting credentials, and filtering malicious domains and URLs. Priority collections include JAR samples, NetSupport configuration elements, license data, persistence file paths, and logs indicating remote NetSupport activity. Telemetry must provide granular EDR, registry, scheduled-task, and network visibility, with IR gaps centered on limited Java execution logging, incomplete visibility into targeted spear-phishing emails, and absence of a baseline for legitimate NetSupport use. Validation should include controlled detonation of samples to confirm forensic signatures, refine detection logic, and strengthen FAIR-aligned estimates of dwell time and impact.

Reverse Engineering

Reverse engineering should focus first on the JAR loader’s behavior: a single Java class built with Java 8 whose main function is to download NetSupport binaries over HTTP from an embedded URL, save them to predictable user paths, configure them for autorun, and maintain a launch counter while showing fake error messages to keep the user distracted. Analysts should document how the loader constructs download paths, writes files, registers Run keys, drops Startup .bat files, and creates scheduled tasks, as well as how the start-limit counter file is created under %USERPROFILE%\Documents\…*.dat and read to control execution frequency. Evasion characteristics to capture include the reliance on legitimate Java runtimes, lack of obfuscation to avoid heuristic triggers, use of a legitimate remote-administration tool as the payload, and fake error dialogs that give the appearance of benign failure while the RAT is quietly installed. Persistence must be carefully annotated across the three mechanisms (Startup folder .bat file, HKCU Run key, logon-triggered scheduled task), each providing discrete indicators for defenders to search and for rule authors to codify. Indicators should include JAR filenames, embedded URLs, HTTP paths for NetSupport downloads, file-system locations for the .dat counter and RAT binaries, registry values and keys, scheduled-task names and commands, and any recurring strings in the fake error messages. Dynamic analysis hooks should instrument Java execution, HTTP network calls, and file and registry APIs, while static analysis should extract configuration constants, URLs, and persistence templates from the JAR; similar approaches should be used to unpack and inspect the NetSupport deployment bundle for configuration peculiarities (e.g., hard-coded license data or custom settings). Broader malware reverse engineering recommendations include clustering JAR samples by configuration and infrastructure, tracking version drift in the loader template and NetSupport versions used, and feeding extracted indicators and behaviors back into detection engineering, monitoring baselines, and FAIR scenario updates.

CTI

From a CTI perspective, analysts should confirm whether justice, legal, or government-adjacent organizations across Kyrgyzstan, Uzbekistan, and nearby regions—as well as partners or vendors interacting with Ministries of Justice—fall within the threat’s likely target set, assess the recurrence and consistency of justice-themed spear-phishing since 2023, and identify persistent TTPs such as localized PDFs, “case materials” links, Java-install prompts, JAR loaders, NetSupport RAT deployment, and geo-fenced delivery. SIR efforts should document missing IOCs, the need for additional malware samples, gaps in infrastructure understanding, attribution uncertainties, and required telemetry such as email, HTTP, DNS, EDR, and persistence-related logs. Collection priorities include continuous OSINT monitoring, sandbox and malware-repository tracking, internal telemetry review, and collaboration with ISACs/ISAOs and CERTs, supported by selective dark-web monitoring. Mapping work should cluster infrastructure, align TTPs with ATT&CK, compare current behavior to earlier STRRAT-based operations, and refine confidence levels by identifying evolving patterns like expanded geo-fencing or shifts in persistence mechanisms. All findings should feed updated IOCs, behavioral indicators, and analytic judgments into monitoring, hunting, incident-response playbooks, and FAIR-aligned risk modeling.

GRC and Testing

Governance

Governance should ensure policies explicitly cover targeted spear-phishing, installation of runtimes like Java, and the use of remote-administration tools such as NetSupport, with clear rules on when such software may be installed and by whom, especially in justice-related or government-adjacent environments. Oversight functions (risk committees, security steering groups) should regularly review campaign intelligence on Bloody Wolf and similar actors, verifying that email security, endpoint controls, and third-party access policies remain aligned with the observed tactic of impersonating Ministries of Justice and using localized lures. RA, PM, and PL family governance documents should be updated to reflect regionally targeted APT campaigns, formalizing assumptions around moderate-to-high threat event frequency, elevated susceptibility due to high-trust government-themed content, and the business impact of persistent remote access to legal or governmental data. The risk register should include a specific scenario for Java-based loaders deploying legitimate remote-administration tools, tracking existing controls, residual risk, and planned improvements (for example, tightening policies on legacy Java versions and unmanaged NetSupport usage). Board and executive communication should translate this into clear language: an advanced actor is using simple, low-cost techniques to gain long-term, covert access to sensitive systems, so leadership should be briefed on current exposure, control roadmaps, and FAIR-informed loss ranges to justify investments in monitoring, training, and hardening of remote-access and email channels.

Audit and Offensive Security Testing

Audit and offensive security testing should concentrate on how existing controls perform against the exact behaviors described: justice-themed spear-phishing with PDF attachments, instructions to install Java, execution of small JAR loaders, and deployment of NetSupport with multi-layer persistence. Auditors should test whether controls mapped to areas like social engineering resistance, least functionality, configuration management, malware protection, system monitoring, boundary protection, and software integrity actually produce evidence of enforcement when users are prompted to install Java or run JARs from external domains, and document evidence gaps where logs or approvals are missing. Policies governing email, software installation, remote-administration tools, and persistence mechanisms need explicit validation through red-team and spear-phishing exercises that mimic “case materials” lures and localized justice-ministry branding, followed by purple-team sessions that step through the JAR execution and NetSupport installation chain to confirm detection, containment, and escalation. Penetration testing scope should include attempts to reproduce the attack path end-to-end on representative workstations, including creating Run keys, startup .bat files, and scheduled tasks, to verify whether these actions are blocked, logged, and alerted upon. Control validation should use the results of these tests to confirm or refute assumptions in audit findings and FAIR models, demonstrating whether technical and human controls can prevent or at least rapidly detect and respond to this style of APT-driven remote-access compromise.

Awareness Training

Awareness training should emphasize the social engineering patterns highlighted in the information: highly tailored spear-phishing that impersonates Ministries of Justice, localized PDFs labeled as “case materials,” instructions to install Java to view documents, and fake error messages that hide malicious activity. Human failure modes to address include unquestioned trust in government-branded communications, willingness to install software from prompts in unsolicited documents, and failure to report unusual error dialogs or unexpected Java pop-ups. Role-specific content should prioritize justice, legal, and government-facing staff, but also include admins, executives, finance, and customer-facing personnel who may interact with legal or government workflows, teaching them to scrutinize case-related attachments, verify sender domains independently, and escalate any request to install or run new software tied to case documentation. Training should spell out behavioral indicators such as mismatched domains, unusual language in official documents, prompts to install or update Java outside normal channels, and error messages appearing immediately after opening “case materials.” Phishing simulations should closely mirror the Bloody Wolf lures, including localized language, justice-ministry branding, URLs leading to spoofed sites, and prompts to download or run additional software, while communication guidelines should require verification and internal contact points for any unexpected justice-related requests received via email. Reinforcement cycles and effectiveness measures should track click rates on justice-themed simulations, rates of reporting suspicious messages, and reductions in unapproved software installations over time, feeding results back into governance, monitoring, and FAIR susceptibility estimates.

Indicators of Compromise

Hash

9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917

d96856cd944a9f1587907cacef974c0248b7f4210f1689c1e6bcac5fed289368

e83861e331e90f2a41cd749e33614fb61595c1b9e29d9808b8dd68cc38968c47

81a6e79f3ac731bb3c7efbdcaf18df7662964b8e7907018b1b4551f3562f1b66

8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

88ea8049e3fa6045cf6fbc85f8e761cae8680d2ec0915436e0b4a015c314827d

313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a

07a191254362664b3993479a277199f7ea5ee723b6c25803914eedb50250acf4

a8bd79d517ce20c88626ef5df4e216c46a4a7770223a7f6f11d926afaaee606f

89027f1449be9ba1e56dd82d13a947cb3ca319adfe9782f4874fbdc26dc59d09

0a6f173bb87d26221af673f0762264499bd606ce45049cd14035fa02290afe3e

a74612ae5234d1a8f1263545400668097f9eb6a01dfb8037bc61ca9cae82c5b8

abc075efebb3b9b13aabe9792b1e3ae52964864ce208dfa79275197f309104d5

62153a6ce1b9b908581674dd53a68cacfa1f73d917b65ccf1cf61f399de7cb1a

0aade8a7b5072d6cbb0f600a0cba624689226dae5f3d7656f04757604c30d4f9

1ce2ef4aca27191388e54d66726f415af5c921d5d29ec98d6e2a7eebd4d60358

f39bee852b0188081eda084b0b443c12e2e0b4f724eda21f03cf752814d78f27

8c2bf904df889cb7a5879e2cc5ba08a11f57cb7dd3938f4b2be4cc8974a051f4

83a6feb6304effcd258129e5d46f484e4c34c1cce1ea0c32a94a89283ccd24f9

dd3203a394f27d990274ca5fdb82bcf1a69f82a6b8f9d002d9569c01a04718c9

edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796

9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917

d96856cd944a9f1587907cacef974c0248b7f4210f1689c1e6bcac5fed289368

e83861e331e90f2a41cd749e33614fb61595c1b9e29d9808b8dd68cc38968c47

81a6e79f3ac731bb3c7efbdcaf18df7662964b8e7907018b1b4551f3562f1b66

8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

88ea8049e3fa6045cf6fbc85f8e761cae8680d2ec0915436e0b4a015c314827d

313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a

1d0d69f4003ca4f5f36c4c42a8e771bc932afcba2d6b70d82a044939a8dd9081

738be6216caeba1d3d37a8b7c7696e39eeb366e8397a96d23b840e85fd1bcc21

e1bd780d6a872c2ec443ef394c094739279309f986b899033f3e0bf0b55dbf09

07cb8339e7fff0e61f1374693a6ead52e55dd3efb20f3fc7a0ebe78426e5f41c

a0f35e2b969ed2516abd3de9cc6aa0e71e1a2e60151c04aa20c40e82b3035a0c

198fc0ef529f0773cc3dbca06d3763188259cccb475b5d467a0bc12fcf012353

ddb7a4d0c78ee11ce38e9f37d55e9065edf74c0f97ddfbffdffee10dfb87107e

a67ba852d16d9805ea7f0e8a9ac2a4e6cf8c411a246a6e7e2f0f3f51a4cab238

19508523a67dbc143b664e4ef797defec624d9afdec50c54290842a15dbb3053

85bcddbac3a342dcbe58cbd576aa17973fd03665384b01ffebeeaa2da3eed6cc

1acd4592a4eb0c66642cc7b07213e9c9584c6140210779fbc9ebb76a90738d5e

4c0f737cbfec30e0c11f4fef5be68c6486ac01d3bc15465bb18dd1dbece0ff87

195c34912cac6690afdf5134fb69b596d191693ef1d3da6c11fb9ae673093c4d

13d3dad0892925052628b2db0782a9da4eba30909af82c4ecdfe4193bf99231c

445c9684a2d9c3fbd4038f96a58ae7ad287bb5e69f59f66a0e481d98ed94525d

5d840b741d1061d51d9786f8009c37038c395c129bee608616740141f3b202bb

ca5de848bc21cc7aabe98339929cdc4d96b8b86f82c04bada65a00302df25800

db6d165ddd8b2dbe684b59872dde0639d0dae1a4f6569add0b448786142024b9

c48738873fa66da88f9e3acf0855f2049b5a0d2b7c480c9a277a66cb90814b10

d63ea8b4361a1b4f93f145bc813dc7435ff36cf2ced27ece0d48a9e6ac08c2be

41484153083d52e910605f832cc72d82f5b4a9f05d6f9ce02287d6a1246f3bb1

86625437e6947378ae34c0b31a6b1d81dee0bacfef34e5a80e522468802636d4

95d76324d78828b8ea159cb168b5bcd8456534b622444b4332e94b6dd63cff19

ad264a1da3d261dd6450ec172fd9560be2b89f6fa38f844ae004238c19474560

debe65555f1c10e59c09431c605c1d4058df60f86b9831d58794cd72546165a1

dcd5ec06f9afa38b8e3402212f7dd42f4f4c8b723c9a03040228e7969389f5be

ea89ad160b44b3c357a812b62206c44bc0591c11cf1ca11749161d27e9902261

f34110425213e6ebbd9dd9ad796cba9acdb5649d927013b66a31ab144174dcd3

7cf6ca770f31986ed5ec53f5822d4d8a95ec46d1f147ba0af67801f0c224dc4d

ab22445d724c66a7207210155d8d760ae645df6ec4c84ca50c14614ed22982c7

1acd4592a4eb0c66642cc7b07213e9c9584c6140210779fbc9ebb76a90738d5e

bbcf1a1516b51411bb5c422a91068854debba4c0e1b4025d595de9a051aad31d

f26572999b8f1b640924ce0451111cb75b3d7ae8f066201cf912f4ac327f4809

39424c07d0147f8951283b09c4c10359f4e8ec8b1b778706e020bb4f94fe7e5a

521c8ba171a0b5f83f0cb92dd4a0f8837366146f725c5efd12df85b5578f155f

711531dd05fc988ffd821a1de4f609beff090a1f569c855d28c9dc06d7a98d67

195c34912cac6690afdf5134fb69b596d191693ef1d3da6c11fb9ae673093c4d

711531dd05fc988ffd821a1de4f609beff090a1f569c855d28c9dc06d7a98d67

a67ba852d16d9805ea7f0e8a9ac2a4e6cf8c411a246a6e7e2f0f3f51a4cab238

85bcddbac3a342dcbe58cbd576aa17973fd03665384b01ffebeeaa2da3eed6cc

bff79d224cd372ad3c39de2f451ccc890ebaa95e45297820c9051ab0560fe6c2

19508523a67dbc143b664e4ef797defec624d9afdec50c54290842a15dbb3053

212caed4168b857967a2d1f06840a501521e4cef57ba77fb8c1e85ee613f9180

4c0f737cbfec30e0c11f4fef5be68c6486ac01d3bc15465bb18dd1dbece0ff87

bbcf1a1516b51411bb5c422a91068854debba4c0e1b4025d595de9a051aad31d

d63ea8b4361a1b4f93f145bc813dc7435ff36cf2ced27ece0d48a9e6ac08c2be

File Name

pcicapi.dll

nskbfltr.inf

ir50_32.dll

kbdibm02.DLL

msvcr100.dll

kbd106n.dll

PCICHEK.DLL

pcicl32.dll

advpack.dll

remcmdstub.exe

ir50_qcx.dll

AudioCapture.dll

ozbekiston.exe

tcctl32.dll

kbdlk41a.dll

kbd101c.DLL

KBDSF.DLL

qwave.dll

NSM.LIC

client32.ini

HTCTL32.DLL

pcicapi.dll

nskbfltr.inf

ir50_32.dll

kbdibm02.DLL

msvcr100.dll

kbd106n.dll

PCICHEK.DLL

Domain

minjust-kg[.]com

esf-kg[.]com

audit-kg[.]com

ach-uz[.]com

uzaudit[.]com

soliq-uz[.]com

hisobot-uz[.]com

ttbbaits[.]com

nac-ac[.]com

hgame33[.]com

ravinads[.]com