Loading story…
Cavalry Werewolf, an advanced persistent threat (APT) group with reported overlaps to YoroTrooper and other clusters such as SturgeonPhisher, Silent Lynx, Comrade Saiga, ShadowSilk, and Tomiris, has been actively targeting Russian state agencies and critical industries. The group has been observed deploying custom malware families, notably FoalShell and StallionRAT, in a series of sophisticated cyberattacks. According to cybersecurity vendor BI.ZONE, the attackers initiated their campaigns by sending highly targeted phishing emails that masqueraded as official correspondence from Kyrgyz government officials. These emails were crafted to deceive recipients within Russian government agencies, as well as organizations in the energy, mining, and manufacturing sectors. In some instances, the attackers compromised legitimate email accounts belonging to the Kyrgyz Republic's regulatory authority, increasing the credibility and effectiveness of their phishing attempts. The phishing emails typically contained RAR archive attachments, which, when opened, delivered the FoalShell or StallionRAT malware payloads to the victims' systems. FoalShell is a lightweight reverse shell available in Go, C++, and C# versions, enabling attackers to execute arbitrary commands via cmd.exe on compromised machines. StallionRAT, written in Go, PowerShell, and Python, provides similar capabilities, including command execution, file loading, and data exfiltration. The campaign was observed between May and August 2025, indicating a sustained and coordinated effort to infiltrate Russian public sector networks. The technical sophistication of the malware, including its multi-language implementations, suggests a well-resourced and adaptable threat actor. The use of Telegram as a command-and-control (C2) channel has also been reported, allowing the attackers to maintain covert communications and control over infected hosts. The group’s ties to Tomiris, which Microsoft has linked to a Kazakhstan-based actor known as Storm-0473, further suggest a regional nexus and possible state sponsorship. Previous related attacks by ShadowSilk targeted government entities in Central Asia and the Asia-Pacific region, using similar remote access trojans and reverse proxy tools. The ongoing campaign highlights the persistent threat posed by Cavalry Werewolf to Russian governmental and industrial targets, as well as the broader regional implications of their operations. Security researchers emphasize the importance of monitoring for phishing attempts impersonating government officials and the deployment of custom malware families like FoalShell and StallionRAT. The attacks underscore the need for robust email security, user awareness training, and advanced endpoint detection to mitigate the risk from such sophisticated APT campaigns. The incident also demonstrates the evolving tactics of threat actors in leveraging both social engineering and technical innovation to achieve their objectives. Organizations in the targeted sectors are advised to review their security postures and implement proactive threat hunting measures. The campaign serves as a reminder of the complex and dynamic nature of cyber threats facing government and critical infrastructure entities in the region.
See the actors and campaigns active against you right now.
5 events from the most recent confirmed update back to the earliest known activity.
BI.ZONE publicly disclosed that Cavalry Werewolf had targeted Russian agencies and adjacent sectors using FoalShell, with reporting also highlighting Telegram-based command-and-control. The disclosure consolidated details on the campaign's targeting, malware, and infrastructure.
Based on the 2025 campaign analysis, BI.ZONE assessed that Cavalry Werewolf activity has ties to Tomiris, which Microsoft previously attributed to the Kazakhstan-linked actor Storm-0473. This supported BI.ZONE's hypothesis that the operation is affiliated with Kazakhstan.
During the May–August 2025 campaign, Cavalry Werewolf deployed the FoalShell and StallionRAT malware families against Russian agencies. The malware enabled remote command execution, while StallionRAT also supported data exfiltration through a Telegram bot and use of reverse proxy tools such as ReverseSocks5Agent/ReverseSocks5.
Between May and August 2025, the threat actor tracked as Cavalry Werewolf targeted the Russian public sector and adjacent industries with phishing emails impersonating Kyrgyz government officials. In at least one case, the attackers used a compromised legitimate Kyrgyz regulatory authority email account to deliver malicious RAR archives.
BI.ZONE said its analysis of Telegram and underground forum postings over the previous year indicated that at least 500 Russian companies were compromised. The intrusions commonly involved attacks on public-facing web applications, persistence via gs-netcat, and database theft using tools such as Adminer, phpMiniAdmin, and mysqldump.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky reported that the threat actor **Bloody Wolf**—tracked by the vendor as **Stan Ghouls**—is running a spear-phishing campaign primarily targeting organizations in **Uzbekistan** and **Russia**, with additional, lower-volume activity observed in other countries. The activity, ongoing since at least 2023, has targeted sectors including manufacturing, finance, and IT, and has also been observed hitting government, logistics, healthcare, and education entities. Reported victim counts for the current wave are on the order of **50+ in Uzbekistan** and **~10 in Russia**, with the actor assessed as likely financially motivated, though the heavy use of remote-access tooling may also support espionage objectives. The intrusion chain relies on phishing emails carrying **malicious PDF lures** (e.g., court/government-themed documents) that embed links leading to a downloader/loader, after which the actor deploys **NetSupport RAT** (a legitimate remote administration tool) for remote control—representing a shift from prior use of **STRRAT**. Kaspersky noted the loader’s behavior includes user-deception (fake error messages) and basic execution controls (e.g., limiting repeated installation attempts), while another reported lure uses a social-engineering pretext that victims must install a **Java Runtime Environment update**, ultimately delivering a **malicious JAR**—a technique Kaspersky described as a distinctive fingerprint for this actor. Prior related reporting cited phishing activity in Kyrgyzstan distributing similar tooling, indicating a broader regional focus beyond the current Uzbekistan/Russia emphasis.
Jun 29, 2026
BI.ZONE Threat Intelligence reported that the **Fluffy Wolf** cluster, also tracked as **Watch Wolf**, launched a new campaign against Russian companies in construction, consulting, engineering, retail, e-commerce, and industrial sectors. The attackers used phishing emails disguised as financial claims or debt-collection notices from partners or contractors, delivering malicious archives either directly or through GitHub links to make the messages appear legitimate and improve delivery past email filters. The campaign deployed a multi-stage malware chain that included a new C++ loader dubbed **PowerLoader**, which starts hidden PowerShell, retrieves scripts from a command server, and downloads **PureCrypter** to install final payloads. BI.ZONE said the operators used **PureLogs** for credential and data theft, a new **PureRAT** variant with the `PluginRemoteDesktop` module for remote access, and in at least one case deployed **Pay2Key** ransomware based on **Mimic**; researchers added that much of the toolset appears to have been sourced through malware-as-a-service offerings.
Jun 29, 2026
The **Sticky Werewolf** cyber-espionage group has been linked to phishing attacks against Russian scientific, industrial, and government organizations, with later reporting also identifying targets in Belarus. In one campaign, attackers impersonated Russia’s Ministry of Industry and Trade in emails carrying decoy documents and a password-protected archive; another wave used phishing links generated through **IP Logger** to disguise delivery URLs while collecting victim profiling data such as IP address, location, browser version, and operating system. Researchers also tied the activity to earlier spoofed-email operations themed around Russian state bodies including **EMERCOM**, the Ministry of Construction, and the **FSB**. The intrusions ultimately deployed **Ozone RAT**, and in some cases **Darktrack RAT**, while showing victims decoy files to mask the infection. Analysts said the Ozone RAT loader was copied into `%TEMP%` under names such as `utorrent.exe`, established persistence through a shortcut in the Windows Startup folder, and used a modular chain in which it downloaded an encrypted DLL from a command-and-control server, saved it as `data.dbf`, decrypted it, and loaded it reflectively into memory via the Delphi API function **BTMemoryModule**. The malware was reported to support remote command execution, file and process management, registry changes, keylogging, screen, webcam, and microphone capture, password theft from browsers and mail clients, hidden virtual network computing (**HVNC**) control, reverse proxying, payload delivery, and self-deletion.
Aug 15, 2026