Cavalry Werewolf APT: Exposing FoalShell and StallionRAT Malware

Operation Trusted Horse: Unmasking the Cavalry Werewolf APT

From May to August 2025, the threat group known as Cavalry Werewolf (also tracked as YoroTrooper, Silent Lynx, and others) launched a sophisticated campaign targeting Russia's public sector and key industries, including energy, mining, and manufacturing. This attack cluster specializes in leveraging trusted relationships through highly targeted phishing and deploying a custom-built arsenal of multi-language malware.

In this blog, I will explain the two main malware families leveraged in the attack campaign, FoalShell and StallionRAT. It also includes a comprehensive list of IOCs observed in the wild for security researchers.

Phishing and Initial Access: The Cloak of Authority

Cavalry Werewolf's primary method of initial access involves spear-phishing emails disguised as official correspondence from legitimate Kyrgyz government officials. The attackers have been observed using fake email addresses from entities like the Ministry of Economy and Commerce and the Ministry of Transport and Communications. Crucially, evidence suggests they may also compromise real official email accounts for their operations, blurring the line between impersonation and actual compromise.

The phishing emails carry a RAR archive containing one of the group’s two main malware families: 

• the FoalShell reverse shell, or 

• the StallionRAT remote access trojan. 

The filenames used mimic genuine official documents, exploiting the victim's trust and sense of urgency (e.g., "three-month results of joint operations," "shortlist of employees to receive bonuses").

Detection Opportunity: Outlook Cache Monitoring A key defensive measure is to track the creation of suspicious archives with document-like names within the %LocalAppData%\Microsoft\Windows\INetCache\Content.Outlook directory, a known location for files downloaded by the Outlook client.

FoalShell: The Multi-Language Command-and-Control Backdoor

FoalShell is a lightweight reverse shell designed to grant attackers command line access on a compromised host via cmd.exe. Its variants demonstrate the attackers' versatility, with implementations observed in C#, C++, and Go.

FoalShell C# Analysis

The C# version is a straightforward reverse shell, establishing a connection and redirecting the input and output streams of a hidden cmd.exe process over the network socket. The hidden window style ensures stealth.

The core functionality involves a continuous loop to receive commands, execute them via cmd.exe, and return the standard and error output back to the command-and-control (C2) server. The C2 IP address observed is 188.127.225.191 on port 443.

FoalShell C++ Analysis

The C++ variant utilizes a shellcode loader to evade static analysis. An obfuscated FoalShell shellcode is embedded within the executable's resources under the name output_bin.

The resource is read, memory is allocated with RWE (Read, Write, Execute) permissions using VirtualAlloc, and the shellcode is executed. The shellcode then deobfuscates the main reverse shellcode. The shellcode's network functionality connects to a C2 and launches a hidden cmd.exe process:

The C2 IP for this variant is 109.172.85.63.

FoalShell Go Analysis

The Go implementation uses its own networking stack to achieve similar reverse shell capabilities, connecting to C2 62.113.114.209 on port 443. It forces the executed cmd.exe process to run in a hidden window style.

Threat Hunting: FoalShell Monitor for cmd.exe processes launched by suspicious parent processes in common temporary/public directories, or processes with short lifetimes that execute common system discovery commands.

StallionRAT: Telegram-Controlled Access

StallionRAT is a Remote Access Trojan (RAT) used by Cavalry Werewolf, also with multi-language implementations (Go, PowerShell, Python). Its unique feature is using a Telegram bot as its Command and Control (C2) channel, allowing the attackers to execute arbitrary commands, manage files, and exfiltrate data.

StallionRAT PowerShell Delivery

In one attack, a C++ launcher was used to execute a PowerShell instance with a Base64-encoded command, a common technique to evade security products that monitor simple command arguments.

The decoded PowerShell logic handles Telegram message parsing and C2 communication, implementing three key commands:

1. /list: Retrieves and formats the list of compromised devices.
2. /go [DeviceID] [command]: Executes a command on a specific host using Invoke-Expression.
3. /upload [DeviceID]: Downloads a file via Telegram to the host, saving it to C:\Users\Public\Libraries\%fileName%

Post-Exploitation and Lateral Movement

Post-compromise activity reveals the group's intent to establish persistence and expand control:

• Persistence: StallionRAT binaries (e.g., win.exe) were deployed to C:\Users\Public\Libraries and added to the Run registry key for autostart.

• Proxying: The attackers leveraged SOCKS5 proxying tools like ReverseSocks5Agent to tunnel traffic, observed connecting to C2 addresses 96.9.125.168:443 and 78.128.112.209:10443.

• Reconnaissance: Standard post-exploitation commands were used to map the network and host environment, including ipconfig /all, netstat, whoami, and net user /dom.

Threat Hunting: StallionRAT

• Encoded Commands: Correlate powershell.exe execution events featuring the -EncodedCommand parameter.

• Persistence: Monitor for file creation in C:\Users\Public\Libraries\ and modifications to the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry hive.

• Reconnaissance: Search for simultaneous execution of environment discovery commands (whoami, ipconfig, netstat) by low-reputation or newly created processes.

Expanding Horizons: A Broad Attack Surface

Beyond the initial Russian targets, analysis of desktop artifacts indicates that Cavalry Werewolf may be preparing to expand its geographical focus:

• A file in the Tajik language suggests a potential interest in Tajikistan.

• Desktop files named in Arabic indicate reconnaissance or testing against targets in the Middle East.

This expansion, coupled with the apparent testing of other tools like AsyncRAT (based on a found installer file), highlights a rapidly evolving and ambitious threat actor.

Conclusion and Recommendations

Cavalry Werewolf is a sophisticated and adaptable threat actor capable of crafting multi-language malware and executing targeted, high-confidence phishing attacks that leverage a veneer of official trust. The use of custom tools like FoalShell and StallionRAT demonstrates a commitment to operational secrecy and a capacity to rapidly evolve their attack techniques.

Organizations targeted by this group must:

1. Enhance Email Verification: Implement strict procedures for verifying the authenticity of correspondence, especially from new or external governmental contacts. Train users to inspect full email headers, not just the display name.

2. Bolster Endpoint Detection: Deploy and tune EDR solutions to detect the specific artifacts discussed:

   • powershell.exe with -EncodedCommand.

   • Suspicious cmd.exe parent/child relationships.

   • Registry persistence attempts in the Run keys.

   • Network connections to the identified C2 IP addresses.

3. Monitor for Lateral Tools: Flag the execution of known SOCKS5 proxy binaries or the use of common reconnaissance commands by non-standard users or processes.

Indicators of Compromise (IOCs)

FoalShell Malware

StallionRAT

Archives

ReverseSocks5

ReverseSocks5Agent

How Picus Helps Defend Against Cavalry Werewolf APT Attacks?

The Picus Security Validation Platform safely emulates Cavalry Werewolf APT attack scenarios leveraging FoalShell and StallionRAT malware. Through the Picus Threat Library, it replicates the tactics, techniques, and procedures (TTPs) observed in these campaigns to reveal detection and prevention gaps across EDR, NGFW, and SIEM technologies, before adversaries can exploit them.

You can also test your defenses against hundreds of other malware variants, such as SnipBot, SlipScreen Loader, RustyClaw, within minutes with a 14-day free trial of the Picus Platform.