Cavalry Werewolf raids Russia’s public sector with trusted relationship attacks

The malicious actors pose as government officials and utilize own crafted malware in their attacks

Tactic	Technique	Procedure
Initial Access	Phishing: Spearphishing Attachment	Cavalry Werewolf uses attachments in phishing emails to spread the malware
Execution	Command and Scripting Interpreter: PowerShell	Uses a C++ launcher to run PowerShell with a Base64-encoded command containing the StallionRAT malware code
	Command and Scripting Interpreter: Windows Command Shell	Uses FoalShell reverse shells to remotely execute commands in the `cmd.exe` interpreter
	User Execution: Malicious File	The victim must unpack the malicious RAR and run the executable file to initiate the system compromise process
Persistence	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder	Cavalry Werewolf adds StallionRAT to the `Run` registry key: `[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] WinRVN = "C:\users\public\libraries\win.exe"`
Defense Evasion	Deobfuscate/Decode Files or Information	Uses shellcode from the `output_bin` resource of the C++ launcher, which deobfuscates and executes the FoalShell reverse shell
	Hide Artifacts: Hidden Window	Uses an invisible window in FoalShell reverse shells to hide activity performed in the user interface
	Masquerading: Space after Filename	Uses multiple spaces or the `_` character before the extension of malicious executable files, for example: `Служебная записка от 20.08.2025[multiple spaces].exe` `Службеная записка от 16.06.2025___________________________.exe`
	Obfuscated Files or Information: Embedded Payloads	Stores malicious payload in the launcher’s resource section in C++
	Obfuscated Files or Information: Encrypted/Encoded File	Encodes StallionRAT PowerShell code using Base64
Discovery	Account Discovery: Domain Account	Uses the `net user /dom` command to retrieve a list of domain accounts
	File and Directory Discovery	Uses the `ls` command to retrieve information about the directory contents
	System Information Discovery	Uses StallionRAT to retrieve the victim’s computer name
	System Network Configuration Discovery	Uses the `ipconfig /all` and `netstat` commands to collect network information about compromised hosts
	System Network Configuration Discovery: Internet Connection Discovery	Uses the `ping` command to check the availability of hosts within the victim’s infrastructure
	System Owner/User Discovery	Uses the `whoami` command to obtain the compromised host’s username
Command and Control	Application Layer Protocol: Web Protocols	Uses HTTPS in StallionRAT to communicate with `https://api.telegram.org/`
	Ingress Tool Transfer	Uses StallionRAT to download files onto the victim’s computer
	Non‑Application Layer Protocol	Uses sockets in FoalShell reverse shells to communicate with the C2 server
	Proxy	Uses SOCKS5 proxy tools, ReverseSocks5Agent and ReverseSocks5
	Web Service: Bidirectional Communication	Uses the Telegram Bot API in StallionRAT to send and receive messages
Exfiltration	Exfiltration Over Web Service	Uses Telegram to transmit information about the victim’s computer