Cavalry Werewolf APT Targets Multiple Sectors Using FoalShell and StallionRAT
## Cybersecurity: Cavalry Werewolf APT Campaign
Cybersecurity: Cavalry Werewolf APT Campaign
From May to August 2025, the advanced persistent threat group Cavalry Werewolf, also known as YoroTrooper and Silent Lynx, conducted a sophisticated attack campaign targeting Russia's public sector and critical industries, including energy, mining, and manufacturing.
The campaign utilized trusted relationships to execute highly targeted spear-phishing attacks, deploying a custom multi-language malware arsenal. The initial compromise was primarily achieved through spear-phishing emails, impersonating official communication from Kyrgyz governmental agencies. Attackers crafted fake addresses from ministries such as the Ministry of Economy and Commerce or the Ministry of Transport and Communications. Phishing lures included RAR archives disguised as legitimate documents, containing either FoalShell—a reverse shell backdoor—or StallionRAT, a remote access trojan.
A crucial detection tip for defenders is to monitor the creation of archives with document-like names within the %LocalAppData%\Microsoft\Windows\INetCache\Content.Outlook directory.
FoalShell is a compact reverse shell, with variants in C#, C++, and Go. It provides attackers with reliable command-line access on infected hosts via a hidden cmd.exe process.
C# Version : Connects to a command-and-control (C2) server at 188.127.225.191:443 and redirects command streams. C++ Variant : Utilizes a shellcode loader connecting to C2 at 109.172.85.63 . Go Implementation : Connects to C2 62.113.114.209:443 , leveraging Go's networking stack.
The campaign utilized trusted relationships to execute highly targeted spear-phishing attacks, deploying a custom multi-language malware arsenal.
Threat hunting guidance includes monitoring suspicious cmd.exe instances spawned by processes in temporary directories.
StallionRAT: Telegram-Controlled Espionage
StallionRAT is a Remote Access Trojan implemented in Go, PowerShell, and Python, using Telegram bots for command and control.
PowerShell Variant : Deployed using a C++ dropper, executes Base64-encoded commands. Operations : Parses Telegram messages for device commands and file transfers.
Persistence is achieved via registry Run keys, utilizing tools like ReverseSocks5Agent for tunneling.
Enforce verification of unexpected or unofficial correspondence. Train personnel to scrutinize email headers. Deploy advanced EDR/XDR monitoring for encoded PowerShell and suspicious cmd.exe activities. Monitor for lateral movement indicators and known proxy tools. Key paths: %LocalAppData%\Microsoft\Windows\INetCache\Content.Outlook , C:\Users\Public\Libraries FoalShell C2s: 188.127.225.191:443, 109.172.85.63, 62.113.114.209:443 StallionRAT/Proxy: 96.9.125.168:443, 78.128.112.209:10443 Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Remaining vigilant against such threats is crucial as Cavalry Werewolf continues to adapt and expand its reach.
Based on reporting by GBHackers.