Threat Actors Pose as Government Officials to Attack Organizations with StallionRAT
## Cybersecurity: Recent Campaign Using StallionRAT
Cybersecurity: Recent Campaign Using StallionRAT
A recent campaign identified as Cavalry Werewolf has targeted government and critical infrastructure organizations in Russia and adjacent regions. This operation involves adversaries sending phishing emails that impersonate officials from Kyrgyz government agencies.
The phishing emails include malicious RAR archives deploying tools such as the FoalShell reverse shell and StallionRAT. StallionRAT utilizes a modular design and Telegram-based command-and-control (C2) infrastructure, becoming a significant tool for threat actors.
Bi.Zone analysts detected this activity between May and August 2025, noting its reach into sectors such as mining, energy, and manufacturing. Phishing emails lure victims with authentic-looking logos and email addresses sourced from official websites.
Upon execution, these attachments release a reverse shell and a PowerShell-based loader for StallionRAT, granting immediate access and long-term control over compromised systems.
A recent campaign identified as Cavalry Werewolf has targeted government and critical infrastructure organizations in Russia and adjacent regions.
The impact of this campaign includes data exfiltration, deployment of SOCKS5 proxy tools for lateral movement, and domain enumeration to map internal networks. The use of Triton RAT as routine correspondence enhances execution rates while bypassing defenses. Compromised systems join Telegram chats, facilitating real-time command execution and data extraction.
Infection Mechanism and Loader Workflow
StallionRAT’s infection mechanism employs a dual-stage loader written in C++. Upon initiation, the launcher uses PowerShell with a Base64-encoded command to execute the primary payload entirely in memory, thereby avoiding disk-based detections:
powershell -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand WwBWAHIAYQBiAGkAbABpAHQA...
Once decoded, StallionRAT generates a random DeviceID and retrieves the host’s computer name. It continuously polls the Telegram Bot API for new instructions, enabling command execution via Invoke-Expression .
This approach evades traditional antivirus solutions by not writing the main binary to disk and leveraging PowerShell for legitimacy. Telegram's encrypted traffic further obscures detection, making StallionRAT a significant threat to even well-defended environments.
Based on reporting by Cyber Security News.