A targeted cyberattack was executed by the hacker group Cavalry Werewolf against a Russian government-owned entity in July 2025. The attack began with a phishing campaign using password-protected archives disguised as legitimate documents, deploying a previously unknown backdoor (BackDoor.ShellNET.1) based on open-source Reverse-Shell-CS code. This allowed remote command execution, persistence via Windows registry edits, and deployment of additional malware, including the Trojan.FileSpyNET.5 infostealer—designed to exfiltrate documents, spreadsheets, images, and system data to an external server.The attackers leveraged Windows BITSAdmin to download further payloads, established SOCKS5 tunnels for covert communication, and used Telegram bots to control compromised systems. Trojanized versions of WinRAR, 7-Zip, and Visual Studio Code were also distributed to launch secondary infections. The group gathered confidential government data, internal network configurations, and user credentials via Windows commands (`whoami`, `ipconfig /all`, `net user`), indicating a focused effort on espionage and long-term infiltration.Cavalry Werewolf, linked to prior campaigns targeting Russian state agencies and industrial firms (energy, mining, manufacturing), employed custom tools like FoalShell and StallionRAT, suggesting advanced capabilities with potential ties to other threat actors (Silent Lynx, YoroTrooper). The breach risks compromised national security data, operational disruptions, and further escalation if the group expands targeting to critical infrastructure or civilian systems.