Cavalry Werewolf APT Targets Russian Agencies with FoalShell and Telegram C2

3 October 2025, Cavalry Werewolf APT has been observed increasing activity between May and August 2025, targeting Russian state agencies as well as energy, mining, and manufacturing enterprises across the region, according to BI[.]ZONE Threat Intelligence.

The group relies on custom-built malware, including FoalShell reverse shells and StallionRAT, controlled through Telegram bots, with initial access achieved mainly via targeted phishing that masked emails as official correspondence from Kyrgyz government officials.

Campaigns impersonated agencies such as the Ministry of Economy and Commerce and the Ministry of Transport and Communications, delivering malicious RAR archives carrying FoalShell or StallionRAT payloads, with real email accounts sometimes compromised for future phishing.

FoalShell exists in C#, C++, and Go implementations, supporting a hidden command-line interface and obfuscated shellcode, while StallionRAT operates in Go, PowerShell, and Python to maintain persistent control and exfiltrate data through a Telegram C2. BI[.]ZONE notes that commands include reconnaissance and persistence actions, and that the attackers have shown signs of widening their targets with Arabic-language file names and a Tajik-language file suggesting possible expansion.