FoalShellMalware
According to BI. ZONE, FoalShell is a simple reverse shell used by Cavalry Werewolf, written in Go, C++, and C#. FoalShell allows attackers to execute arbitrary commands in the cmd.exe command line interpreter on a compromised host.From MISP Galaxy
Last reported 9 days ago, by The Hacker News2 reports
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1684Social Engineering
“The phishing emails are sent from compromised government accounts and make use of official-looking documents to lend the social engineering attack a veneer of credibility.”
- T1053.005Scheduled Task
“…aders built with PS2EXE, a tool that packages PowerShell scripts as Windows executables, to fetch reverse-shell payloads and create scheduled tasks for persistence.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks“The attacks lead to the deployment of custom reverse shells like FoalShell, Chvost, Laplas, and PickleShell that facilitate interactive remote access to compromised hosts, according to Cisco Talos and Recorded Future Insikt Group, which are tracking the campaign under the moniker…”
-
TAG-193’s Regional Espionage Operations“Its tooling includes LAPLAS, multiple FoalShell variants, and PowerShell-based reverse shells.”
Thanks — we review every report.