Threat Actors Pose as Government Officials to Attack Organizations with StallionRAT

In a recent wave of targeted phishing, the Cavalry Werewolf cluster escalated its operations by impersonating government officials and deploying FoalShell and StallionRAT malware. The campaign began by registering or compromising email addresses belonging to Kyrgyz government agencies and posing as employees from the Ministry of Economy and Commerce, the Ministry of Culture, Information, Sports and Youth Policy, and the Ministry of Transport and Communications.

Phishing emails arrived with RAR attachments designed to mimic official documents, with some packages containing FoalShell and others StallionRAT, which uses a Telegram bot for command and control. StallionRAT operates via a C++ launcher that executes PowerShell with a Base64-encoded command and assigns a random DeviceID between 100 and 10,000, while continuously polling the Telegram API for commands such as /list, /go [DeviceID] [command], and /upload [DeviceID].

Analysis notes include examples of Cyrillic file names used to disguise government memos, and the piece stresses the need for verifying sender identity and scrutinising attachments and links. It also urges organisations to bolster email authentication protocols (SPF, DKIM, DMARC) and implement attachment sandboxing. 3 October 2025