Massive offensive launched on Russian businesses

The Clubfoot Wolf cluster executed a widespread phishing campaign in mid-2026 targeting Russian and some Belarusian organizations across diverse industries, focusing on wholesale chemical distributors. The attack vector involved phishing emails with ZIP attachments containing decoy documents and malicious LNK files. When executed, these LNK files launched PowerShell scripts that downloaded and installed NetSupport Manager, a legitimate remote administration tool leveraged by the attackers for unauthorized remote access and control. The adversary employed URL shorteners to obscure command and control infrastructure and used multiple decoy files to increase victim trust. The campaign demonstrated adaptive delivery and infection techniques over time.

The campaign enabled attackers to gain remote access to targeted organizations by abusing a legitimate remote administration tool, potentially allowing data theft, espionage, or further network compromise. The use of phishing and social engineering increased the likelihood of initial infection. The targeting of critical sectors such as manufacturing, chemical distribution, healthcare, and IT could have significant operational and economic impacts on affected organizations.

No official patch or fix is applicable as this is a phishing and social engineering campaign leveraging legitimate software. Organizations should enhance phishing detection and user awareness training, implement email filtering to block malicious attachments, and monitor for unauthorized use of remote administration tools like NetSupport Manager. Restricting or monitoring PowerShell script execution and LNK file handling can reduce risk. Since no vendor advisory or patch is indicated, check relevant security advisories for updates on detection and prevention.