static-urls · Crawled Jul 25, 2026
Cavalry Werewolf raids Russia’s public sector with trusted relationship attacks | Learn more
56 IoCs 1 Actors 2 Malware
Read original article ↗
AI Summary
Cavalry Werewolf conducted targeted phishing campaigns from May to August 2025, primarily against Russian public sector entities and critical infrastructure organizations. The attackers impersonated Kyrgyz government officials and delivered custom malware, including FoalShell reverse shells and StallionRAT, via malicious RAR attachments. These tools enabled remote command execution, data exfiltration, and persistence through registry modifications, with command and control communications routed through Telegram bots and proxy tools.
AI-extracted · verify before operational use
Extracted Entities 3 found
Indicators of Compromise 56 extracted
| Type | Value | Detail |
|---|---|---|
| SHA-256 | 27a11c59072a6c2f57147724e04c7d6884b52921da2629fb0807e0bb93901cbc | Details → |
| SHA-256 | 3cd7f621052919e937d9a2fdd4827fc7f82c0319379c46d4f9b9dd5861369ffc | Details → |
| SHA-256 | c3df16cce916f1855476a2d1c4f0946fa62c2021d1016da1dc524f4389a3b6fa | Details → |
| SHA-256 | e15f1a6d24b833ab05128b4b34495ef1471bd616b9833815e2e98b8d3ae78ff2 | Details → |
| SHA-256 | dae3c08fa3df76f54b6bae837d5abdc309a24007e9e6132a940721045e65d2bb | Details → |
| SHA-256 | 8404f8294b14d61ff712b60e92b7310e50816c24b38a00fcc3da1371a3367103 | Details → |
| SHA-256 | 8e6d7c44ab66f37bf24351323dc5e8d913173425b14750a50a2cbea6d9e439ba | Details → |
| SHA-256 | fa6cdd1873fba54764c52c64eadca49d52e5b79740364ef16e5d86d61538878d | Details → |
| SHA-256 | 0e7b65930bc73636f2f99b05a3bb0af9aaf17d3790d0107eb06992d25e62f59d | Details → |
| SHA-256 | c9ffbe942a0b0182e0cd9178ac4fbf8334cae48607748d978abf47bd35104051 | Details → |
| SHA-256 | 04769b75d7fb42fbbce39d4c4b0e9f83b60cc330efa477927e68b9bdba279bb8 | Details → |
| SHA-256 | 7da82e14fb483a680a623b0ef69bcfbd9aaaedf3ec26f4c34922d6923159f52f | Details → |
| SHA-256 | c26b62fa593d6e713f1f2ccd987ef09fe8a3e691c40eb1c3f19dd57f896d9f59 | Details → |
| SHA-256 | 1dfe65e8dc80c59000d92457ff7053c07f272571a8920dbe8fc5c2e7037a6c98 | Details → |
| SHA-256 | a8ada7532ace3d72e98d1e3c3e02d1bd1538a4c5e78ce64b2fe1562047ba4e52 | Details → |
| SHA-256 | cc9e5d8f0b30c0aaeb427b1511004e0e4e89416d8416478144d76aa1777d1554 | Details → |
| SHA-256 | ec80e96e3d15a215d59d1095134e7131114f669ebc406c6ea1a709003d3f6f17 | Details → |
| SHA-256 | 8e7fb9f6acfb9b08fb424ff5772c46011a92d80191e7736010380443a46e695c | Details → |
| SHA-256 | b13b83b515ce60a61c721afd0aeb7d5027e3671494d6944b34b83a5ab1e2d9f4 | Details → |
| SHA-256 | af3d740c5b09c9a6237d5d54d78b5227cdaf60be89f48284b3386a3aadeb0283 | Details → |
| SHA-256 | 4f17a7f8d2cec5c2206c3cba92967b4b499f0d223748d3b34f9ec4981461d288 | Details → |
| SHA-256 | 22ba8c24f1aefc864490f70f503f709d2d980b9bc18fece4187152a1d9ca5fab | Details → |
| SHA-256 | 148a42ccaa97c2e2352dbb207f07932141d5290d4c3b57f61a780f9168783eda | Details → |
| SHA-256 | 7084f06f2d8613dfe418b242c43060ae578e7166ce5aeed2904a8327cd98dbdf | Details → |
| SHA-256 | ab0ad77a341b12cfc719d10e0fc45a6613f41b2b3f6ea963ee6572cf02b41f4d | Details → |
| SHA-256 | 6b290953441b1c53f63f98863aae75bd8ea32996ab07976e498bad111d535252 | Details → |
| SHA-256 | cc84bfdb6e996b67d8bc812cf08674e8eca6906b53c98df195ed99ac5ec14a06 | Details → |
| SHA-256 | fbf1bae3c576a6fcfa86db7c36a06c2530423d487441ad2c684cfeda5cd19685 | Details → |
| SHA-256 | a3ec2992e6416a3af54b3aca3417cf4a109866a07df7b5ec0ace7bd1bf73f3c6 | Details → |
| IP | 188[.]127[.]225[.]191 | Details → |
| IP | 94[.]198[.]52[.]200 | Details → |
| IP | 91[.]219[.]148[.]93 | Details → |
| IP | 185[.]244[.]180[.]169 | Details → |
| IP | 109[.]172[.]85[.]95 | Details → |
| IP | 185[.]231[.]155[.]111 | Details → |
| IP | 185[.]173[.]37[.]67 | Details → |
| IP | 188[.]127[.]227[.]226 | Details → |
| IP | 62[.]113[.]114[.]209 | Details → |
| IP | 96[.]9[.]125[.]168 | Details → |
| IP | 78[.]128[.]112[.]209 | Details → |
| Filename | О результатах трёх месяцев совместной работы [redacted].exe | Details → |
| Filename | Список сотрудников выдвинутых к премии ко Дню России.exe.exe | Details → |
| Filename | Приказ о поощрении сотрудников ко дню России (Т-11а) № 1 от 30.05.2025.exe | Details → |
| Filename | О ПРЕДОСТАВЛЕНИИ ИНФОРМАЦИИ ДЛЯ ПОДГОТОВКИ СОВЕЩАНИЯ.exe | Details → |
| Filename | О работе почтового сервера план и проведенная работа.exe | Details → |
| Filename | О проведении личного приема граждан список участников.exe | Details → |
| Filename | Службеная записка от 16.06.2025___________________________.exe | Details → |
| Filename | Программный офис Управления Организации Объединенных Наций по наркотикам и преступности (УНП ООН).exe | Details → |
| Filename | План-протокол встречи о сотрудничестве представителей должн.лиц.exe | Details → |
| Filename | Аппарат Правительства Российской Федерации по вопросу отнесения реализуемых на территории Сибирского федерального округа.exe | Details → |
| Filename | Информация по письму в МИД от 6 июля статус и прилагаемые документы.exe | Details → |
| Filename | Служебная записка от 20.08.2025[multiple spaces].exe | Details → |
| Filename | Служебная записка от 12.08.2025[multiple spaces].exe | Details → |
| Filename | win.exe | Details → |
| Filename | rev.exe | Details → |
| Filename | revv2.exe | Details → |
MITRE ATT&CK TTPs 13 techniques
T1027 Obfuscated Files or Information · Defense Evasion T1027.005 Indicator Removal from Tools · Defense Evasion T1059.001 PowerShell · Execution T1059.003 Windows Command Shell · Execution T1069.002 Domain Groups · Discovery T1070.006 Timestomp · Defense Evasion T1083 File and Directory Discovery · Discovery T1087.002 Domain Account · Discovery T1140 Deobfuscate/Decode Files or Information · Defense Evasion T1204.002 Malicious File · Execution T1547.001 Registry Run Keys / Startup Folder · Persistence T1566 Phishing · Initial Access T1566.001 Spearphishing Attachment · Initial Access