Cavalry Werewolf APT Targets Russian Organizations Using FoalShell and Telegram C2

Cybersecurity: Cavalry Werewolf APT Activity Update

The Cavalry Werewolf, an advanced persistent threat (APT) group with a focus on Russia, has been actively enhancing its attack strategies through new malware variants and the use of Telegram-based command-and-control (C2) systems.

It is crucial for security teams to have real-time visibility into the tools used by this group to maintain effective detection and prevention strategies. Delays in understanding tools such as FoalShell and StallionRAT could lead to vulnerabilities in defense mechanisms.

Phishing Campaigns and Attack Strategy

Recently, Cavalry Werewolf has initiated targeted phishing campaigns against various Russian organizations. The attackers impersonate employees from Kyrgyz government agencies, such as the Ministry of Economy and Commerce, to deceive recipients into downloading malicious archives. These phishing emails typically contain RAR attachments with FoalShell or StallionRAT binaries.

One of the campaigns utilized a legitimate email address likely compromised from the Kyrgyz Republic’s regulatory authority website to lend credibility to their phishing attempts. This tactic underscores the importance of verifying both sender identity and email content to prevent such sophisticated impersonation efforts.

FoalShell is a simple yet effective reverse shell developed in multiple programming languages, including Go, C++, and C#. Each version allows hidden execution of cmd.exe , providing attackers with full command-line access on compromised systems.

FoalShell C# : Utilizes standard .NET APIs for input/output redirection. Known filenames include О результатах трёх месяцев совместной работы [redacted].exe . FoalShell C++ : Uses a launcher with obfuscated shellcode. Notable filenames include Программный офис Управления Организации Объединенных Наций по наркотикам и преступности (УНП ООН).exe . FoalShell Go : Establishes a network connection to a remote server, launching cmd.exe in hidden mode. Example filename: Служебная записка от 20.08.2025 [multiple spaces].exe .

Detecting FoalShell activity involves monitoring for suspicious archives in %LocalAppData%\Microsoft\Windows\INetCache\Content.Outlook and unexpected cmd.exe processes.

StallionRAT and Telegram-Based C2 Operations

StallionRAT, developed in Go, PowerShell, and Python, enhances Cavalry Werewolf’s capabilities with features like arbitrary command execution and data exfiltration. This malware family employs a Telegram bot as its C2 channel.

A C++ launcher initiates StallionRAT using a Base64-encoded PowerShell command. Once active, it communicates with the Telegram bot to execute various commands, including registry persistence and environment reconnaissance.

To detect StallionRAT activities, security configurations should include monitoring PowerShell launches with -EncodedCommand and suspicious registry modifications.

Evidence of Tajik-language archives and Arabic-named files suggests that Cavalry Werewolf's operations extend into Central Asia and the Middle East. The inclusion of tools like AsyncRAT indicates ongoing development and diversification of malware capabilities.

Effective defense against Cavalry Werewolf requires continuous cyber threat intelligence and proactive threat hunting. Organizations should employ automated telemetry analysis and regularly update detection signatures for new malware behaviors to maintain a robust defense posture.

Based on reporting by GBHackers.