New "Cavalry Werewolf" Attack Hits Russian Agencies with FoalShell and StallionRAT

A threat actor known to share overlaps with the hacking group YoroTrooper has been observed targeting the Russian public sector with FoalShell and StallionRAT, researchers say. According to BI[.]ZONE, the activity is being tracked under the moniker Cavalry Werewolf, and is thought to have commonalities with clusters such as SturgeonPhisher, Silent Lynx, Comrade Saiga, ShadowSilk and Tomiris.

The campaign’s initial access appears to rely on targeted phishing emails disguising themselves as official Kyrgyz government correspondence, with the main targets being Russian state agencies and energy, mining and manufacturing enterprises. The latest phishing attacks, observed between May and August 2025, distribute RAR archives that deliver FoalShell or StallionRAT, with at least one case reportedly using a compromised Kyrgyz Republic regulatory authority email address to distribute messages.

FoalShell is described as a lightweight reverse shell, while StallionRAT can execute commands, exfiltrate data via a Telegram bot and manage compromised hosts. BI[.]ZONE notes Cavalry Werewolf is actively expanding its arsenal, underscoring the need for rapid visibility into the tools deployed by the cluster.