Cavalry Werewolf Unleashed A New Nation State Threat Targeting Energy And Government Sectors solutions by Intertec System
What we do
Who we are
Insights
Careers
Cavalry Werewolf Unleashed: A New Nation-State Threat Targeting Energy and Government Sectors
A cyberespionage syndicate named Cavalry Werewolf used sophisticated phishing methods to pose as Kyrgyz government officials in order to target Russian government agencies and important industries like manufacturing, mining, and energy between May and August 2025. The campaign used unusual tools like Telegram bots for command and control to distribute custom malware, such as FoalShell and StallionRAT, which allowed for remote access, data theft, and persistence. The actor probably originates from Kazakhstan and appears to be broadening its geographical emphasis. It has been linked to well-known threat groups such as YoroTrooper and Tomiris. Separately, web application attacks compromised more than 500 Russian companies, exposing a wider and growing threat to the region’s public and private sector infrastructure.
Technical Description
Cavalry Werewolf is a recently identified threat actor that uses spoofed or compromised Kyrgyz government email accounts to deliver RAR archives containing advanced malware. The campaign makes use of FoalShell, a cross-compiled reverse shell (Go/C++/C#), as well as StallionRAT, a multi-language remote access trojan that uses Telegram for command and control. These programs support remote command execution, data exfiltration, and persistence methods such as PowerShell obfuscation, Run key registry modifications, and file placement in unusual folders. The details and technicalities of the campaign are discussed further.
Delivery and Infection Chain:
The primary method by which Cavalry Werewolf obtains initial access is through targeted spear-phishing. In emails that impersonate Kyrgyz government officials (including those sent from compromised Kyrgyz mailboxes), weaponized RAR attachments that unpack FoalShell or StallionRAT are delivered. Additionally, attackers exploit public-facing web application compromises (gs-netcat/web shells) and legitimate admin tools (Adminer, mysqldump) to extend their footholds. Their Infection Chain is followed as mentioned below,
- Through social engineering, the actor lists high-value targets and gathers email addresses, public-facing app details, and human targets.
- In order to increase the credibility of future deceptions, the actor, if feasible, compromises official Kyrgyz government mailboxes.
- Targets receive spoof or compromised Kyrgyz government-style emails with links to compromised public web apps or weaponized RAR attachments.
- When the victim extracts or runs the RAR payload—typically through user action—FoalShell or StallionRAT variants are dropped and launched.
- Malware creates C2: StallionRAT connects using a Telegram-based bot or creates proxy tunnels (ReverseSocks5); FoalShell launches an interactive reverse shell.
- Devices are identified, credentials are gathered, and system/database artifacts are gathered via remote commands and integrated modules.
- The actor maintains persistence via running registry key modifications and nonstandard file locations (such as C:\Users\Public\Libraries), deploying proxy agents, abusing legitimate admin tools, or moving laterally using credentials that were obtained.
- Using web shells, Telegram uploads, SOCKS5 tunnels, or database dump tools like mysqldump, collected data is staged locally and exfiltrated.
- To keep or restore access for follow-on operations, the actor installs extra backdoors or web shells (gs-netcat, admin tools).
Technical Capabilities
Cavalry Werewolf demonstrates polished operational tradecraft, including targeted social engineering using spoofed identities and legitimately compromised mailboxes, the ability to run targeted espionage and opportunistic web-app campaigns, rapid cross-platform tooling adoption (porting code between Go, C++, C#, Python, and PowerShell), and flexible C2 design that combines commodity services (Telegram) with anonymizing proxies (SOCKS5). The group uses legitimate administrative utilities (Adminer, phpMiniAdmin, mysqldump) for data extraction and lightweight persistent implants and web shells (gs-netcat) to maintain long-term footholds, indicating coordinated red-team style planning and tolerance for multi-stage, stealthy intrusion lifecycles.
With its small footprint for reconnaissance, easy portability across Windows environments, and dependable remote command execution via cmd.exe, FoalShell is a powerful reverse shell family that has been compiled across Go, C++, and C# variants. Instead of handling large amounts of data, it is made for quick interactive control and script invocation. Further, the StallionRAT is a modular RAT that integrates Telegram-based C2 Implemented in Go, PowerShell, and Python, for data transfer and command issuance. It can be used to upload files (/upload), execute arbitrary commands using InvokeExpression (/go), and enumerate infected hosts (/list). Additionally, it can be used in conjunction with ReverseSocks5 agents to create covert tunnelling for lateral movement and exfiltration. These tools, which have layered obfuscation and persistence mechanisms that make standard detection and takedown efforts more difficult, allow for both immediate interactive control and sustained, feature-rich operations.
Attribution and Evolution
The group is actively experimenting with multi-language malware, commodity web shells, and hybrid C2 (consumer platforms + proxy chains), indicating a shift from opportunistic compromises toward more deliberate, scalable espionage operations. Telemetry and tooling overlap link Cavalry Werewolf to clusters tracked as YoroTrooper, Tomiris (Microsoft’s Storm-0473 lineage), ShadowSilk, and others, suggesting a regional nexus—possibly Kazakhstan-affiliated—with evolving capabilities.
Active Campaign and Geographic Spread
Between May-Aug 2025, activity targeted Russian state agencies and critical infrastructure sectors (energy, mining, manufacturing). However, English, and Arabic filenames and incidents reported in Russia, Tajikistan, and the Middle East indicate a broader operational footprint. Based on analysis and related reports also highlight widespread web-app compromises across Russian organizations, underscoring both targeted and opportunistic campaign elements.
Conclusion:
Cavalry Werewolf is an adaptive espionage threat actor that uses targeted phishing, mailbox compromise, custom cross-platform shells, and web-attack techniques. Defenders should treat incidents as persistent, multi-stage intrusions that require coordinated detection (email, endpoint, network, and application layers), rapid containment, and cross-organizational intelligence sharing to limit damage and prevent re-compromise.
Impact
The use of proxying, resilient persistence, and encrypted/consumer C2 channels by the actor makes detection and remediation more difficult. Successful intrusions could have high impact that would result in extensive espionage and data theft (sensitive government and industrial documents, database exfiltration), covert long-term access for follow-on operations, potential operational disruption via lateral movement or sabotage, and significant reputational, regulatory, and supply-chain risk to affected organizations.
IOC and Context Details
| Topics | Details |
|---|---|
| Tactic Name | Initial Access, Execution, Persistence, Command & Control,<br> Discovery, Lateral Movement, Exfiltration |
| Technique Name | Spear-phishing (attachment/link)<br> Mailbox compromise<br> Command execution<br> Reverse shell<br> Registry persistence<br> Web shell deployment<br> Proxying / SOCKS5 tunneling<br> Data extraction & exfiltration |
| Sub Technique Name | Spear-phishing with malicious RAR attachment<br> Compromised or impersonated legitimate email account<br> Commands executed via cmd.exe<br> Registry Run-key persistence<br> Files dropped in non-standard locations<br> (C:\Users\Public\Libraries)<br> Reverse SOCKS5 tunnel for proxying attacker traffic<br> Database dumping via mysqldump / Adminer abuse |
| Attack Type | Malware |
| Targeted Applications | Microsoft Exchange, MySQL, RAR Archives |
| Region Impacted | Russia, Kyrgyzstan, Tajikistan, Middle East |
| Industry Impacted | Government, Energy, Mining, Manufacturing,<br> Commerce, Finance, Education |
| IOC’s | File Names (FoalShell)<br> О результатах трёх месяцев совместной работы [redacted].exe<br> Список сотрудников выдвинутых к премии ко Дню России.exe.exe<br> Приказ о поощрении сотрудников ко дню России (Т-11а) №1 от 30.05.2025.exe<br> О ПРЕДОСТАВЛЕНИИ ИНФОРМАЦИИ ДЛЯ ПОДГОТОВКИ СОВЕЩАНИЯ.exe<br> О работе почтового сервера план и проведенная работа.exe<br> О проведении личного приема граждан список участников.exe<br> Служебная записка от 16.06.2025___________________________.exe<br> Программный офис Управления ООН по наркотикам и преступности.exe<br> План-протокол встречи о сотрудничестве представителей должностных лиц.exe<br> Аппарат Правительства Российской Федерации<br> по вопросу реализации проектов в СФО.exe<br> Информация по письму в МИД от 6 июля и прилагаемые документы.exe<br>File Names (StallionRAT)<br> Аппарат Правительства Российской Федерации<br> по вопросу реализации проектов в СФО.exe<br>Hashes (SHA-256)<br> 27a11c59072a6c2f57147724e04c7d6884b52921da2629fb0807e0bb93901cbc<br> 3cd7f621052919e937d9a2fdd4827fc7f82c0319379c46d4f9b9dd5861369ffc<br> c3df16cce916f1855476a2d1c4f0946fa62c2021d1016da1dc524f4389a3b6fa<br> e15f1a6d24b833ab05128b4b34495ef1471bd616b9833815e2e98b8d3ae78ff2<br> dae3c08fa3df76f54b6bae837d5abdc309a24007e9e6132a940721045e65d2bb<br> 8404f8294b14d61ff712b60e92b7310e50816c24b38a00fcc3da1371a3367103<br> 8e6d7c44ab66f37bf24351323dc5e8d913173425b14750a50a2cbea6d9e439ba<br> fa6cdd1873fba54764c52c64eadca49d52e5b79740364ef16e5d86d61538878d<br>Reverse SOCKS5<br> fbf1bae3c576a6fcfa86db7c36a06c2530423d487441ad2c684cfeda5cd19685<br>Reverse SOCKS5 Agent<br> a3ec2992e6416a3af54b3aca3417cf4a109866a07df7b5ec0ace7bd1bf73f3c6<br>IP Addresses<br> 188.127.225[.]191:443<br> 94.198.52[.]200:443<br> 91.219.148[.]93:443<br> 185.244.180[.]169:443<br> 109.172.85[.]95:443<br> 185.231.155[.]111:443<br> 185.173.37[.]67:443<br> 188.127.227[.]226:443<br> 62.113.114[.]209:443<br> 96.9.125[.]168:443<br> 78.128.112[.]209:10443 |
| CVE | N/A |
Recommended Actions
- Implement multi-factor authentication (MFA) on all email and critical systems.
- Employees should be trained to spot and report spear-phishing emails, particularly those that pose as government representatives
- Monitor and restrict use of PowerShell and command-line execution with logging and alerts on suspicious encoded commands.
- Implement stringent email filtering and attachment scanning procedures, preventing unknown senders and malicious RAR archives.
- Audit and harden persistence points, including registry run keys and odd file locations, on a regular basis.
- Deploy network monitoring to uncover illegal Telegram bot communications and unusual SOCKS5 proxy traffic.
- Conduct regular vulnerability assessments and patch web applications to prevent compromise via public-facing services.
- Maintain updated endpoint detection with behavioral analytics to identify custom malware like FoalShell and StallionRAT.