Cavalry Werewolf
Kazakhstan
Tracked by CyberSIXT since 27 Aug 2025
- Articlesall time
- 12
- Articleslast 30 days
- 2
- CVEs exploitedattributed · all time
- 1
- Research reportsall time
- 0
12 articles from 4 outlets since 27 Aug 2025; the latest 11 days ago.
- Article
Show as table
Profile
Written by CyberSIXT from the sources listed below. Updated 26 Oct.
Malpedia lists YoroTrooper and Silent Lynx as aliases of Cavalry Werewolf2. MISP Galaxy attributes its origin to KZ3.
GBHackers reported that Cavalry Werewolf targeted Russia’s public sector, energy, mining and manufacturing between May and August 20251. GBHackers described spear-phishing messages impersonating Kyrgyz governmental agencies and directing recipients to archives containing FoalShell or StallionRAT1. GBHackers reported that FoalShell provided reverse shell access, while StallionRAT used Telegram for command and control, enabling long-term control and data exfiltration1.
Sources
- Cavalry Werewolf APT Targets Multiple Sectors Using FoalShell and StallionRAT · GBHackers · 2025-10-21
- Cavalry Werewolf: alias · Malpedia
- Cavalry Werewolf: origin · MISP Galaxy
Diamond Model
What the record links to Cavalry WerewolfRecorded associations sorted by Diamond Model vertex. They do not reconstruct an intrusion or establish a campaign. Model: Caltagirone, Pendergast and Betz (2013).
Names and sources
- YoroTrooper
- CyberSIXT coverage, Malpedia, MISP Galaxy
- Cavalry Werewolf
- Malpedia, MISP Galaxy
- Comrade Saiga
- Malpedia, MISP Galaxy
- Salted Earth
- Malpedia, MISP Galaxy
- ShadowSilk
- Malpedia, MISP Galaxy
- Silent Lynx
- Malpedia, MISP Galaxy
- Sturgeon Fisher
- Malpedia, MISP Galaxy
- SturgeonPhisher
- Malpedia, MISP Galaxy
Attributed facts
- Origin
Kazakhstan MISP Galaxy
- Suspected victims
Germany MISP Galaxy
CVEs exploited
1 CVE an article attributes to Cavalry WerewolfVendors targeted
Malware and tools
Malpedia · yorotrooper 3
MITRE ATT&CK® techniques
No MITRE ATT&CK® techniques are recorded for Cavalry Werewolf.
Also mentioned alongside Cavalry Werewolf (not attributed)1 CVE in the same articles
These articles name both the actor and the CVE. They do not attribute exploitation of these CVEs to Cavalry Werewolf.
- Kazakhstan Based Espionage Group Exploits CVE to Target Energy and GovernmentSecurity Affairs
- Silent Lynx Exploits WinRAR Flaw in Attacks on CIS GovernmentsThe Hacker News
- Cavalry Werewolf Launches Cyberattack on Government Agencies to Deploy Network BackdoorGBHackers
- Silent Lynx APT New Attack Targeting Governmental Employees Posing as OfficialsGBHackers
- Operation Peek-A-Baku: Silent Lynx APT Exploits LNK Flaws to Deploy Reverse Shells via GitHub Against Central Asian DiplomacySecurityOnline
- Cavalry Werewolf APT Targets Multiple Sectors Using FoalShell and StallionRATGBHackers
- Cavalry Werewolf APT Targets Russian Organizations Using FoalShell and Telegram C2GBHackers
- New "Cavalry Werewolf" Attack Hits Russian Agencies with FoalShell and StallionRATThe Hacker News
- Cavalry Werewolf APT Targets Russian Agencies with FoalShell and Telegram C2SecurityOnline
- ShadowSilk Unmasked: The Hybrid Espionage Group Targeting Central Asian GovernmentsSecurityOnline
- ShadowSilk Targets Penetration-Testing Tools and Public Exploits to Breach OrganizationsGBHackers
- ShadowSilk Hits 36 Government Targets in Central Asia and APAC Using Telegram BotsThe Hacker News · first in our coverage