Cavalry Werewolf APT Targets Multiple Sectors Using FoalShell and StallionRAT

Cavalry Werewolf, an advanced persistent threat group also tracked as YoroTrooper and Silent Lynx, conducted a campaign between May and August 2025 targeting Russia’s public sector and critical industries including energy, mining and manufacturing.

The operation relied on trusted relationship abuse through highly targeted spear-phishing, with messages masquerading as communications from Kyrgyz governmental agencies and fake addresses drawn from ministries such as the Ministry of Economy and Commerce or the Ministry of Transport and Communications. Victims opened archives containing FoalShell, a reverse shell backdoor, or StallionRAT, a remote access Trojan controlled via Telegram, enabling long‑term control and data exfiltration.

FoalShell variants connect to C2 servers at 188.127.225[.]191:443, 109.172.85[.]63, and 62.113.114[.]209:443, while StallionRAT communications are observed to use C2 addresses at 96.9.125[.]168:443 and 78.128.112[.]209:10443, with persistence via Run keys and tools such as ReverseSocks5Agent. Defenders are advised to monitor for encoded PowerShell usage, suspicious registry persistence, and archives in Outlook content caches using document-like names.