{
  "name": "Massive offensive launched on Russian businesses",
  "slug": "massive-offensive-launched-on-russian-businesses",
  "description": "In May and June 2026, the Clubfoot Wolf cluster executed a large-scale phishing campaign targeting Russian organizations across manufacturing, retail, e-commerce, agriculture, IT, transportation, healthcare, and science sectors, with primary focus on wholesale distributors of chemical products. Several Belarusian organizations were also compromised. The adversary sent phishing emails disguised as invoices or purchase requests, containing ZIP archives with decoy documents and malicious LNK files. Upon execution, a PowerShell script downloaded and installed NetSupport Manager, a legitimate remote administration tool, which was then used for malicious activities. The attackers employed URL shorteners to hide infrastructure and used multiple decoy files to build victim trust. The campaign demonstrated continuous evolution in delivery methods and infection chains.",
  "published": "2026-07-09T12:53:28.782000+00:00",
  "created_at": "2026-07-10T07:33:29.234000+00:00",
  "modified_at": null,
  "created_at_opencti": "2026-07-10T07:33:29.234000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "belarus",
    "chemical industry",
    "lnk file",
    "netsupport manager",
    "phishing campaign",
    "powershell loader",
    "russian targets",
    "url shortener"
  ],
  "tags": [],
  "related_entities": {
    "indicators": [
      {
        "id": "126b3d88-f9a8-44e8-a3e2-dc61f83f7b4b",
        "name": "b38032f5b2059cacc28246dd0b739e19b6a68daf34add740d5ce6be87354b498"
      },
      {
        "id": "b2005452-c216-4138-a1f8-e1445f4578bd",
        "name": "f15e4e140fceeb393bcb2c8d61a2333b37c30270527b5c48d8440e3ec1e02ae4"
      },
      {
        "id": "a4e9d57e-11e0-4204-91ac-b46672ab1143",
        "name": "11ad9f6c235ea561317d89590fa41d75348019850735b998b60661635ad99e9a"
      },
      {
        "id": "ae89259f-7352-46af-9196-6b69b5c06f5a",
        "name": "9fa461bd75788d27ceb778dc0f9773d641e804b3e10103c482ba4747153178f8"
      },
      {
        "id": "078c1383-6c7d-4098-bbeb-a5ee913ff1ae",
        "name": "b90a7f17b5406db3ee17ec4bc82a704c6128b4ad8652776b4f55bc3948fa8385"
      },
      {
        "id": "365c32ea-50e7-461f-bba4-32bea165be84",
        "name": "https://fleepsterones.fun/media/like"
      },
      {
        "id": "a958152f-78b2-4b2a-ad48-0539edcad216",
        "name": "fb25a19a74bc7549f5e4e1f299886fb09a9d5b4fd4599c5a9b7f2d534ce71691"
      },
      {
        "id": "f10e673f-00c9-4239-95ed-b7c16bf287e4",
        "name": "45154678b808a70316f0172a5012ffdfc7d7ddcde856440099fcdbad64e84ddb"
      },
      {
        "id": "19cab297-36fc-4af4-b404-aa02472dbb71",
        "name": "3325be6c18c35b66e7f527950af97a4235e04d026a81780c135d6cec3f8245db"
      },
      {
        "id": "fc44226d-6f3d-4a5b-9f52-9a31f8ec2399",
        "name": "644ad315071324e7f86e9b04dfc7dae515ca1a7ae386b21207c4ab38d1a164d6"
      },
      {
        "id": "588c3c85-2293-4720-86ae-be81780a81de",
        "name": "79f169be997f883ef02559a0af3f014f63c1c0308931913decd79c0aafaf659f"
      },
      {
        "id": "9e6fb5c6-1e85-43d5-8218-579f7b07710c",
        "name": "https://sunlightfriends.tech/beauty/series"
      },
      {
        "id": "37b6eb20-7839-4735-982e-c5cda6576a1b",
        "name": "6a8dfd602daa3b9dc2ceb146837a7966a37af8ab224ed11478e1f6d87f375b7f"
      },
      {
        "id": "e24a8702-32bc-4f55-9323-d96b2257b447",
        "name": "7b6f6fe88ff9d953965e81b1bed256528c93ff159156bc17b8811d7cfd5dfe47"
      },
      {
        "id": "bb65585a-b14f-4b7a-8030-5134978fca62",
        "name": "31b0f515012355e104a1e4f10baff85c3066a037f17272ce9c2445fd8377a96a"
      },
      {
        "id": "f6a5dc0a-9037-47a6-bdf7-d2fbe57bbb12",
        "name": "b24b8d96ebea10cb7e9ffb73256cc46f9041123e7c2cc26fe92d355a8378a87c"
      },
      {
        "id": "56bf4028-4247-4736-8888-4ce640837d22",
        "name": "fa877d45432e7712d1832508c77f063958a5cec05038152eb2be5e79992c3966"
      },
      {
        "id": "ac8bd29c-531e-495a-8991-f86a7b7bd61c",
        "name": "cee0ad69647d4840013e836b657d8fd79b9be7389ccbc70e15c5cb96bf926f8a"
      },
      {
        "id": "724b7d04-70b6-4851-90bf-95bbfd0b011a",
        "name": "03dbaee9cbc05abb6a35fd7804dcf7e83e0675da40eabcfd161d1d6b387363b3"
      },
      {
        "id": "8c7a61cd-51b0-47cb-8ee9-98f69e09b4e4",
        "name": "https://sunlightfriends.tech/monthly/horoscope"
      },
      {
        "id": "0d4801a2-4fa2-4b98-a8b4-cef40524d1e1",
        "name": "8fde3f60f9ae901a9fa04888d3050c9a65fb63722a4b41a6d6ad7d38183c37d5"
      },
      {
        "id": "618521b7-0b97-4609-98e3-0a9ad65beb56",
        "name": "73bd4f12f3e7d155dfbcb6d016b99d40cce8554964ecc51de40b70fab3a4c3a5"
      },
      {
        "id": "4b8be5bb-5e4e-4960-9a9c-7026c865b68a",
        "name": "82671b7f09811ff38b3cab186776d06cc9e89d434080f1eb26fa1c35767eaca5"
      },
      {
        "id": "3c35e918-7421-43f5-bdfd-78604851ab49",
        "name": "c709c30074155f8f0a431828c23cc08df6959505051578ec28659a47a4da2fa6"
      },
      {
        "id": "b89df3be-f514-49b6-b90b-fe6fc6ad0ec8",
        "name": "https://sunlightfriends.tech/weekly/forecast"
      },
      {
        "id": "30d3d4a4-908e-4510-92d2-0f3844910699",
        "name": "cdf7c97cfb494ade90886765606294db0b98a2576bc1d152bc8c4ec97672b687"
      },
      {
        "id": "114433a3-46a3-4e9b-b671-3937cc57d50b",
        "name": "http://stillpaving.com:1411"
      },
      {
        "id": "d9c19c43-68a1-4e39-8e24-c1fc201f3d24",
        "name": "aedcfbac94161f74b2ce63ad9da2f613809860fc8aa09d6ea0b57e964c47f8a8"
      },
      {
        "id": "7c46d00f-3350-4ebb-a729-f95a894705d3",
        "name": "https://sunlightfriends.tech/learning/portal"
      },
      {
        "id": "de0c57c7-17da-4665-bbef-dd1c337f44e8",
        "name": "https://sunlightfriends.tech/weather/news"
      },
      {
        "id": "3ac371b9-150d-4485-bd37-01bbbddd2960",
        "name": "20c8fd700796b80ea093e23ec812943adfc63c3b8653bb09b581fd7f4127c652"
      },
      {
        "id": "f2e5e2a2-3ae9-473b-a7b3-8cc4a91fa3d3",
        "name": "https://sunlightfriends.tech/nature/today"
      },
      {
        "id": "8f6fd1ca-234b-4975-822a-e6ee7703033b",
        "name": "490585f82a0ddaafd9eead803859e06dafc0219a5bd1c08482c98f3d37eec231"
      },
      {
        "id": "13780c98-a45d-47df-809c-92d07c788fee",
        "name": "fleepsterones.fun"
      },
      {
        "id": "b92a694f-4ffd-48a2-a120-ecc6f67ff5e8",
        "name": "fa07773b3af0539442504f86973fe2a68e040f80ebea388c5ed62d8f94eddb6a"
      },
      {
        "id": "bd81d91d-8401-4dde-96cb-41747c531c05",
        "name": "6478585efed46b0616ca201c51464de7af5ba8985c3b948f9b67db09cbd62e97"
      },
      {
        "id": "e8d69b50-9b72-45c9-857a-af898bd836fb",
        "name": "http://akiliridge.com:1414"
      },
      {
        "id": "66a82d75-c15c-437e-a5c8-dbe8c14fb920",
        "name": "https://fleepsterones.fun/fashion/week"
      },
      {
        "id": "952f13ba-cba7-41a4-bfb5-739b9881bc89",
        "name": "bed54c819cc8ff502fff41f6d9c726836b6086c9afdd47f2261809196c973c38"
      },
      {
        "id": "525cd53a-e812-4afc-b290-a75339c15f5d",
        "name": "https://sunlightfriends.tech/health/shampoo"
      },
      {
        "id": "6f203fb3-910d-49ec-9982-2978b348c874",
        "name": "https://fleepsterones.fun/content/articles"
      },
      {
        "id": "134d2676-2273-4b21-b680-94608a0cafb5",
        "name": "0c2947904711ef63ac3cc24ba2e7a059e318dc219d14eeaebb6b46fd277f7f3d"
      },
      {
        "id": "446ddf08-a2f4-4f47-9371-7a9536a47781",
        "name": "b2e8f9f9a69c1be0d1814b064b73586afbf730e2ab9d9fb10dd5711be4febe85"
      },
      {
        "id": "d4d03a12-6340-48a7-917d-012fa8a44fb8",
        "name": "4972b6583645d28600f076e73def05890b54a9d98c8b328d61f421c79a021db6"
      },
      {
        "id": "4f368e3b-eea6-42d6-afcd-585260fc2f93",
        "name": "http://glowstickspro.com:1411"
      },
      {
        "id": "d75a11e8-beb2-4d41-a63f-36b3ad5a2724",
        "name": "d3c90e61c3ffa059658c36e39334cb38c0b23cbde46f5078705fcfad67c9f3d8"
      },
      {
        "id": "6502815b-115a-4770-a46d-c72c3c8e338e",
        "name": "bea07bc2359e8f3ce914b0027b5548ae58c9a019f330446b2c81050cd9ca1b0d"
      },
      {
        "id": "c6a914be-ca9c-42f6-b379-44cb04432fa3",
        "name": "https://sunlightfriends.tech/latest/news"
      },
      {
        "id": "922a6080-58ea-4ad9-a2c6-ae58021f68d8",
        "name": "38d96dd1c26a7a98c8b55c925863d0f5c8c099a73192c65e3a1e47ea636d3d29"
      },
      {
        "id": "d172e3d6-0c08-48c8-9056-26174d7a7588",
        "name": "http://imhfamily.com:1414"
      },
      {
        "id": "243e750d-06e6-4707-a1a1-11d1d3b33720",
        "name": "53c6a0a51ef3cf9d38034a7600c94e1ae3968dbec5bbb5d9fdcd26764c6b30e2"
      },
      {
        "id": "5e72b9e6-f9bc-4560-908b-99b393e6cff2",
        "name": "imhfamily.com"
      },
      {
        "id": "70f41458-1dc2-46e4-ae68-083386b78595",
        "name": "https://sunlightfriends.tech/world/library"
      },
      {
        "id": "600de26a-04f3-49bc-964c-9318fcf9c898",
        "name": "41c1b4b09cb3185075f57befd5278119ee0a952418144779898378f0963897e9"
      },
      {
        "id": "7d89da55-e932-452a-a874-a687752e3fc8",
        "name": "e20c0900513551265dda37ce5334c71f5b0e8b20e19f9d8391f77987e2458f20"
      },
      {
        "id": "6f7d9721-ecbb-46f3-8fdf-2bcd94b3a7cf",
        "name": "100e0ca51a6a25efac16627be80c7ce992a5506470136e43cb8b24d8828ba82b"
      },
      {
        "id": "df4056f6-0ea4-4963-9284-74a5df237cc8",
        "name": "7f58b98e9d4b2d06dadef2b8656d337283118a135806dd711fb9de51ca63911d"
      },
      {
        "id": "d73df06f-8f68-41d7-a618-0dc01470ab9d",
        "name": "c5a1dee1ae7f0a04dfa91481d0c1d5ad5c887a77e657def8878af600a98fd8c6"
      }
    ],
    "intrusion_sets": [
      {
        "id": "6261ed90-a4cd-4bb3-809d-d7c4bf41e12c",
        "name": "Clubfoot Wolf",
        "slug": "clubfoot-wolf"
      }
    ],
    "attack_patterns": [
      {
        "id": "eaff4611-3c78-4127-8745-726f77ed68ba",
        "name": "T1070.004"
      },
      {
        "id": "5882a135-5b7e-4caf-93e8-80f7df41cef2",
        "name": "T1564.001"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "dc410646-9cdd-427b-92e7-179a54f78f90",
        "name": "T1566.001"
      },
      {
        "id": "81b422de-709e-43bd-b471-2befac0c623a",
        "name": "T1218.011"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "886bf3fa-4e64-498b-9cba-f64619cfd501",
        "name": "T1090.002"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "c12e0e03-aab0-4646-a929-e921a3d27f02",
        "name": "T1219"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "6f00068c-812c-4e2b-9100-2cfa86b3aed9",
        "name": "T1132.001"
      },
      {
        "id": "c998d878-b668-40dd-a84c-9ca7f73caaa4",
        "name": "T1497.003"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "a7262c61-4567-4a00-8cec-aae6264234a9",
        "name": "T1218"
      }
    ],
    "malware": [
      {
        "id": "4fdaffac-927c-436b-a363-95145293f4f8",
        "name": "NetSupport Manager",
        "slug": "netsupport-manager"
      }
    ],
    "observables": [
      {
        "id": "9c6a6f22-2843-4b2d-ab8f-6befe48e8d8b",
        "name": "imhfamily.com"
      },
      {
        "id": "898d9a0e-7057-4431-bb3b-baaa0ef13f40",
        "name": "fleepsterones.fun"
      },
      {
        "id": "7f7eb308-5039-4e2f-b454-f7ccf9ffdaaf",
        "name": "http://glowstickspro.com:1411"
      },
      {
        "id": "6ad09d94-b4f0-4285-b9a3-0305ff75bf2a",
        "name": "https://sunlightfriends.tech/world/library"
      },
      {
        "id": "d4ceef29-d54d-4e2b-8b4a-2c095f19efe6",
        "name": "https://sunlightfriends.tech/monthly/horoscope"
      },
      {
        "id": "604a92fc-6f4c-4653-bb37-a32f193adbe5",
        "name": "https://fleepsterones.fun/media/like"
      },
      {
        "id": "6b7b6e31-a543-40cb-a6d8-0b4e5a40f275",
        "name": "https://sunlightfriends.tech/learning/portal"
      },
      {
        "id": "d7f2fe37-7512-4d95-9ddb-611177a0139e",
        "name": "http://stillpaving.com:1411"
      },
      {
        "id": "b4c933f1-d248-4fc7-9353-eaeab1f177c9",
        "name": "https://sunlightfriends.tech/health/shampoo"
      },
      {
        "id": "06152972-b0f9-4329-b220-a773fbc704bc",
        "name": "https://fleepsterones.fun/fashion/week"
      },
      {
        "id": "8fd30e01-5607-49ab-8154-1c56ec0a7ce9",
        "name": "http://imhfamily.com:1414"
      },
      {
        "id": "f78a1d65-286f-4e4e-9f42-8d46d81c35b2",
        "name": "https://sunlightfriends.tech/nature/today"
      },
      {
        "id": "ace5a21e-2458-4b65-852c-0d4963b58244",
        "name": "https://sunlightfriends.tech/latest/news"
      },
      {
        "id": "9b9d82c5-7ec3-4bb4-9af7-397cf9585f73",
        "name": "http://akiliridge.com:1414"
      },
      {
        "id": "93b8dda9-141e-4a71-b267-e8be063983c2",
        "name": "https://sunlightfriends.tech/beauty/series"
      },
      {
        "id": "787566a1-4742-482c-9e5d-ffb28a93c48a",
        "name": "https://sunlightfriends.tech/weather/news"
      },
      {
        "id": "8ef0f65d-2f68-47a6-ba5d-67954dec06ca",
        "name": "https://fleepsterones.fun/content/articles"
      },
      {
        "id": "59e014fc-0107-45e5-9cfd-36d0cf546bdd",
        "name": "https://sunlightfriends.tech/weekly/forecast"
      }
    ]
  },
  "external_refs": [
    {
      "id": "2ed1acd5-eda5-44de-a93c-9a4351d8c63e",
      "standard_id": "external-reference--25d0a1fd-94df-594f-a16a-a16406deada6",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://bi-zone.medium.com/clubfoot-wolf-launches-massive-offensive-on-russian-businesses-5c2743ff2ebd",
      "hash": null,
      "external_id": null,
      "created": "2026-07-10T07:33:29.141Z",
      "modified": "2026-07-10T07:33:29.141Z",
      "createdById": null
    },
    {
      "id": "580b91fb-14ec-404d-8bca-b990394c7b8b",
      "standard_id": "external-reference--2b881882-5711-54fb-b342-09bb2157d694",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a4f99c8656ebbe895c7e9e5",
      "hash": null,
      "external_id": "6a4f99c8656ebbe895c7e9e5",
      "created": "2026-07-10T07:33:29.112Z",
      "modified": "2026-07-10T07:33:29.112Z",
      "createdById": null
    }
  ]
}