Loading threat actor…
Cavalry Werewolf is a suspected espionage-focused threat actor assessed to be linked to Kazakhstan and active against Russian organizations, particularly state institutions and strategically important enterprises. Reporting has associated the cluster with overlaps or commonalities to YoroTrooper, SturgeonPhisher, Silent Lynx, Comrade Saiga, ShadowSilk, and Tomiris, with the Tomiris connection supporting a Kazakhstan-affiliation hypothesis. The actor has been observed targeting Russian public-sector entities as well as energy, mining, manufacturing, and other critical enterprises. Cavalry Werewolf commonly gains initial access through targeted phishing emails impersonating government officials or agencies, including trusted-relationship lures and messages disguised as official correspondence. Campaigns have used malicious archives and document-themed attachments to deliver malware. The group is known for using reverse-shell backdoors and remote-access tooling, including FoalShell and StallionRAT, to execute arbitrary commands on compromised systems. StallionRAT has also been used to load additional files and exfiltrate collected data. A notable characteristic of the actor’s tradecraft is the use of Telegram for command and control and, in some cases, for data exfiltration via bot-based tasking. The group has also employed reverse proxy and tunneling utilities to support post-compromise operations. Observed behavior includes host reconnaissance, remote command execution, persistence on infected systems, and collection of victim data. Open-source tools have also been used alongside custom malware. The actor’s victimology and operational patterns are consistent with cyber-espionage activity directed at Russian government bodies and adjacent sectors of strategic value.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
7 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 malware families attributed to this actor across reporting.
2 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Targeted intrusion against a Russian government organization; characterized by phishing-based initial access, reverse-shell backdoors, and Telegram API-based C2/control.
Targeted intrusion against a Russian government organization; initial access via phishing emails with malware disguised as official documents; post-compromise use of reverse shells and Telegram API for C2/control.
Conducted a targeted intrusion against a Russian state institution; the report notes use of multiple malicious instruments including open-source tools and describes typical post-compromise actions in victim networks.
Intrusion set targeting Russian aeronautic, government, energy, mining, and manufacturing entities using spearphishing with archive attachments, batch scripts, PowerShell downloaders, and a PowerShell backdoor.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.