🇰🇿

YoroTrooper

APT Group Information theft and espionage 3 zero-day CVEs ETDA ✓

Also Known As 7 names

Cavalry Werewolf Comrade Saiga Salted Earth ShadowSilk Silent Lynx Sturgeon Fisher SturgeonPhisher

Target Countries 35

Countries highlighted in red

Armenia Argentina Australia Azerbaijan Brazil Belarus Canada Switzerland China Colombia Germany Dominican Republic Spain Finland Croatia India Japan Kyrgyzstan Kazakhstan Republic of Moldova Myanmar Malta Mexico Nigeria Netherlands Philippines Pakistan Portugal Romania Russian Federation Tajikistan Turkmenistan Turkey United States Uzbekistan

Sectors Targeted

Energy Financial Government

Details

Origin 🇰🇿 KZ

Last Updated 08 Nov 2023

MITRE ATT&CK 43

T1007 - System Service Discovery T1012 - Query Registry T1016 - System Network Configuration Discovery T1018 - Remote System Discovery T1027 - Obfuscated Files or Information T1033 - System Owner/User Discovery T1036 - Masquerading T1041 - Exfiltration Over C2 Channel T1046 - Network Service Scanning T1053 - Scheduled Task/Job T1053.005 - Scheduled Task T1056 - Input Capture T1056.001 - Keylogging T1059 - Command and Scripting Interpreter T1059.001 - PowerShell T1071 - Application Layer Protocol T1071.001 T1078 - Valid Accounts T1078.002 - Domain Accounts T1083 - File and Directory Discovery T1087 - Account Discovery T1095 - Non-Application Layer Protocol T1104 - Multi-Stage Channels T1105 - Ingress Tool Transfer T1106 - Native API T1127 - Trusted Developer Utilities Proxy Execution T1134 - Access Token Manipulation T1176 T1204 - User Execution T1204.001 - Malicious Link T1204.002 - Malicious File T1547 - Boot or Logon Autostart Execution T1547.001 - Registry Run Keys / Startup Folder T1552 - Unsecured Credentials T1552.001 - Credentials In Files T1560 - Archive Collected Data T1560.001 - Archive via Utility T1566 - Phishing T1566.001 - Spearphishing Attachment T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration to Cloud Storage T1589 - Gather Victim Identity Information T1589.002 - Email Addresses

Related Zero-Days 3

CVE-2024-53104 CVE-2025-0411 CVE-2025-0994

Known Names 2 entries

YoroTrooper Talos

Silent Lynx Seqrite

Observed Target Countries 6

Based on ETDA data — countries highlighted in red

Azerbaijan Kyrgyzstan Tajikistan Turkey Turkmenistan Europe

Description

(Talos) Cisco Talos has identified a new threat actor, which we are naming “YoroTrooper,” that has been running several successful espionage campaigns since at least June 2022. YoroTrooper’s main targets are government or energy organizations in Azerbaijan, Tajikistan, Kyrgyzstan and other Commonwealth of Independent States (CIS), based on our analysis. We also observed YoroTrooper compromise accounts from at least two international organizations: a critical European Union (EU) health care agency and the World Intellectual Property Organization (WIPO). Successful compromises also included Embassies of European countries including Azerbaijan and Turkmenistan. We assess the actor also likely targets other organizations across Europe and Turkish (Türkiye) government agencies. Information stolen from successful compromises include credentials from multiple applications, browser histories & cookies, system information and screenshots.

Tools Used 4

Loda Meterpreter Stink Warzone RAT

Reports & References 3

https://blog.talosintelligence.com/yorotrooper-espionage-campaign-cis-turkey-europe/ https://blog.talosintelligence.com/attributing-yorotrooper/ https://www.seqrite.com/blog/silent-lynx-apt-targeting-central-asian-entities/

ETDA Profile

YoroTrooper

Origin

Kazakhstan

First Seen 2022

Motivation

Information theft and espionage

View on ETDA APT Groups ↗