Clubfoot Wolf
Clubfoot Wolf is a cybercrime syndicate with a financial motive, tracked by Brandefense. It targets 6 sectors, including Technology and Manufacturing, in Russia and Belarus. It uses 32 MITRE ATT&CK techniques.
- NetMedved
- Techniques
- 32
- Exploited CVEs
- No CVE data
- First seen
- Aug 1, 2025
- Last seen
- Jun 1, 2026
- Record updated
Who They Target.
About Clubfoot Wolf.
Clubfoot Wolf is a cybercriminal group, reported as financially motivated, that targets organizations in Russia, and to a lesser extent Belarus, with business-themed phishing that installs the legitimate remote administration tool NetSupport Manager as a remote access trojan. In its May-June 2026 campaign the primary targets were wholesale distributors of chemical products, alongside organizations in manufacturing, retail and e-commerce, agriculture, IT, transportation, healthcare and science.
Emails sent from a Russian webmail service posed as purchase requests, invoices or requests for proposal from Russian companies and carried ZIP archives with sham company documents and a malicious LNK or JScript file; HTA droppers were also distributed in 2025. Activity attributed to the group has been observed from August 2025 through June 2026; these dates are reported at month-level precision, and one vendor reports that the group has used a JScript delivery variant since at least 2024.
Last updated Oct 30, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.