A Russian government organization was targeted by the Cavalry Werewolf hacker group, aiming to collect confidential information and network data. The attack began with phishing emails containing malware disguised as documents. The group utilized various tools including backdoors, trojans, and modified legitimate programs. They employed open-source software, reverse-shell backdoors, and Telegram API for control. The attackers focused on information gathering, network configuration, and establishing persistence in compromised systems. Their tactics included using Windows built-in tools, modifying the registry, and exploiting public directories for malware deployment. The group's sophisticated approach and diverse toolset highlight the evolving threat landscape for government institutions.
