Cavalry Werewolf Launches Cyberattack on Government Agencies to Deploy Network Backdoor

According to Doctor Web’s investigation, the July 2025 attack was a targeted operation attributed to the threat actor group known as Cavalry Werewolf, aimed at government agencies to steal confidential information and map network configurations for deeper access. The intruders used phishing emails with malicious attachments concealed in password‑protected archives, disguised as official documents, delivered via BackDoor[.]ShellNET.1, a backdoor built on the Reverse-Shell-CS open‑source project.

After gaining initial access, Cavalry Werewolf used the Windows tool Bitsadmin to fetch additional payloads, first deploying Trojan[.]FileSpyNET.5 to exfiltrate documents in formats including .doc, .docx, .xlsx, and .pdf, and then installing BackDoor[.]Tunnel.41, which leveraged ReverseSocks5 open‑source software to create SOCKS5 tunnels for covert control.

The campaign also involved a wide arsenal of infection tools, from BAT[.]DownLoader.1138 scripts and various backdoors to encrypted payloads, with operators tampering with legitimate binaries and using public directories for staging. The findings highlight a sophisticated, multi‑stage operation focused on government infrastructure, emphasising the need for robust email filtering, endpoint detection, and network segmentation.