Cavalry Werewolf APT Targets Russian Organizations Using FoalShell and Telegram C2

Cavalry Werewolf, a Russian-focused APT cluster, has intensified its offensive operations by targeting Russian organisations with FoalShell and StallionRAT, and by using Telegram-based C2.

The group has conducted phishing campaigns impersonating Kyrgyz government employees—such as those in the Ministry of Economy and Commerce, the Ministry of Culture, Information, Sports and Youth Policy, and the Ministry of Transport and Communications—to coax recipients into opening malicious archives containing FoalShell or StallionRAT binaries. One campaign even used a legitimate email address harvested from the Kyrgyz Republic’s regulatory authority website to boost credibility.

FoalShell is described as a multi-language reverse shell implemented in Go, C++, and C#, enabling hidden execution of cmd.exe with full command-line access. StallionRAT, written in Go, PowerShell, and Python, employs a Telegram bot as its C2 channel and can perform arbitrary command execution, file loading and data exfiltration, with a sample deviceID noted as 9139.

Evidence of Tajik-language archives and Arabic-named files suggests operations extend beyond Russia and the CIS into Central Asia and the Middle East, with defenders urged to maintain real-time visibility and threat hunting across FoalShell and StallionRAT activities. 7 October 2025