Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Check Point Research

Reddit NetSec

CVE Database V5

Reddit InfoSec News

AlienVault OTX General

SecurityWeek

SANS ISC Handlers Diary

Threatpost

Dark Reading

The Hacker News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A threat actor that's known to share overlaps with a hacking group called YoroTrooper has been observed targeting the Russian public sector with malware families such as FoalShell and StallionRAT. Cybersecurity vendor BI.ZONE is tracking the activity under the moniker Cavalry Werewolf. It's also assessed to have commonalities with clusters tracked as SturgeonPhisher, Silent Lynx, Comrade Saiga,

The Cavalry Werewolf threat actor, tracked by BI.ZONE, is a sophisticated cyber espionage group with overlaps to YoroTrooper and other clusters such as SturgeonPhisher and Tomiris, the latter linked to Kazakhstan-based actors. This group has been actively targeting Russian state agencies and critical infrastructure sectors including energy, mining, and manufacturing through spear-phishing campaigns that impersonate Kyrgyz government officials. The initial access vector involves sending emails with malicious RAR archives containing FoalShell and StallionRAT malware. FoalShell is a lightweight reverse shell implemented in Go, C++, and C#, enabling arbitrary command execution via cmd.exe. StallionRAT, written in Go, PowerShell, and Python, provides extensive remote access capabilities including command execution, file upload, and data exfiltration through a Telegram bot interface. Commands such as /list, /go, and /upload facilitate control over compromised hosts. The attackers also deploy tools like ReverseSocks5Agent to maintain persistence and gather system information. The use of compromised legitimate email accounts enhances the phishing campaign’s effectiveness. The presence of English and Arabic filenames suggests a broader targeting scope beyond Russia. While no active exploits have been reported, the campaign’s sophistication and multi-language approach indicate ongoing experimentation and expansion of their malware arsenal. The threat actor’s ties to Central Asian groups and geopolitical context suggest a strategic espionage motive. The campaign was observed between May and August 2025, with continued monitoring recommended. The malware’s modularity and use of legitimate tools for data extraction complicate detection and response efforts.

Detailed information about New "Cavalry Werewolf" Attack Hits Russian Agencies with FoalShell and StallionRAT. Get real-time updates, technical details, and mit

New "Cavalry Werewolf" Attack Hits Russian Agencies with FoalShell and StallionRAT - Live Threat Intelligence - Threat Radar | OffSeq.com

Original Source

New "Cavalry Werewolf" Attack Hits Russian Agencies with FoalShell and StallionRAT

Cavalry Werewolf, a malicious actor group, targeted Russian state agencies and enterprises in the energy, mining, and manufacturing sectors from May to August 2025. The attackers used targeted phishing emails, posing as Kyrgyz government officials, to gain initial access. They employed custom malware, including FoalShell reverse shells and StallionRAT, controlled via Telegram. The group impersonated or compromised real email accounts from Kyrgyz agencies. Their arsenal includes various versions of FoalShell (Go, C++, C#) and StallionRAT (Go, PowerShell, Python). The attackers executed commands for system reconnaissance, file uploads, and SOCKS5 proxying. Evidence suggests potential expansion to targets in Tajikistan and Middle Eastern countries.

The threat actor group known as Cavalry Werewolf conducted a targeted cyber espionage campaign against Russian public sector entities, specifically focusing on state agencies and enterprises within the energy, mining, and manufacturing sectors from May to August 2025. The attackers leveraged trusted relationship attacks by impersonating Kyrgyz government officials in spear-phishing campaigns to gain initial access. This social engineering tactic involved sending highly targeted phishing emails that appeared to originate from legitimate Kyrgyz agencies, sometimes by compromising real email accounts, thereby increasing the likelihood of successful compromise. Once inside the network, the attackers deployed custom malware tools, primarily FoalShell and StallionRAT, which are remote access trojans (RATs) with multiple language variants (Go, C++, C#, PowerShell, Python). FoalShell functions as a reverse shell, enabling the attackers to execute arbitrary commands, perform system reconnaissance, upload files, and establish SOCKS5 proxy tunnels to pivot within the network. StallionRAT complements these capabilities with additional remote control features and is controlled via Telegram, indicating the use of a popular messaging platform for command and control (C2) communications, which can help evade traditional detection mechanisms. The attackers executed a range of tactics consistent with MITRE ATT&CK techniques such as T1566 (phishing), T1082 (system information discovery), T1049 (network reconnaissance), T1071.001 (application layer protocol: Web protocols), and T1547.001 (boot or logon autostart execution). Although the campaign primarily targeted Russian entities, there is evidence suggesting potential expansion to neighboring countries like Tajikistan and some Middle Eastern nations. No known exploits in the wild or specific vulnerable software versions were identified, indicating the attack relies heavily on social engineering and custom malware rather than exploiting publicly disclosed vulnerabilities.

Detailed information about Werewolf raids Russia's public sector with trusted relationship attacks. Get real-time updates, technical details, and mitigation str

Title	Severity	Type	Source	Date

Threats Affecting Kyrgyzstan

Filter Threats

Threats Affecting Kyrgyzstan

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility