YoroTrooperThreat actor
- cavalry werewolf
- comrade saiga
- salted earth
- ShadowSilk
- Silent Lynx
- sturgeon fisher
- sturgeonphisher
YoroTrooper’s main targets are government or energy organizations in Azerbaijan, Tajikistan, Kyrgyzstan and other Commonwealth of Independent States, based on Cisco Talos analysis. YoroTrooper was also observed compromising accounts from at least two international organizations: a critical European Union health care agency and the World Intellectual Property Organization.From MISP Galaxy
Last reported 5 days ago, by Check Point Research7 reports
ATT&CK techniques
6 of 58 · each with the sentence it comes from- T1053.005Scheduled Task
“…aders built with PS2EXE, a tool that packages PowerShell scripts as Windows executables, to fetch reverse-shell payloads and create scheduled tasks for persistence.”
- T1684Social Engineering
“After relying mainly on social engineering for two years, Silent Lynx appears to be building a more advanced set of attack tools.”
- T1505.003Web Shell
“The zero-day has been used to plant web shells on Nextcloud servers where the app was installed since at least September.”
- T1003OS Credential Dumping
“OS Credential Dumping (T1003)”
- T1003.008/etc/passwd and /etc/shadow
“OS Credential Dumping: /etc/passwd and /etc/shadow (T1003.008)”
- T1005Data from Local System
“Data from Local System (T1005)”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
7 reports, newest first · the exact sentence from each-
19th October – Threat Intelligence Report“Researchers have profiled Silent Lynx, a Kazakhstan-linked espionage group targeting Russian energy infrastructure and government entities in Central Asia.”
-
Risky Bulletin: Russia arrests DataSuckers hacking group“TAG-193/UAT-6275/Silent Lynx: A suspected Kazakh cyber-espionage group has been engaged in a years-long hacking campaign that targeted its fellow former Soviet states.”
-
Silent Lynx: Kazakhstan-Linked Hackers Target Russian Refinery and Government“Silent Lynx: Kazakhstan-Linked Hackers Target Russian Refinery and Government”
-
Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks“Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks”
-
Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations“It overlaps with Silent Lynx (first reported by Seqrite) and sits within a broader set of campaigns connected to YoroTrooper, which we first reported in 2023.”
-
TAG-193’s Regional Espionage Operations“Tracked by Cisco Talos as UAT-6275 and also known as Silent Lynx, TAG-193 combines diplomatic and economic targeting with an interest in environmental policy, water resources, and forestry.”
-
ShadowSilk: A Cross-Border Binary Union for Data Exfiltration“ShadowSilk: A Cross-Border Binary Union for Data Exfiltration”
Indicators in its reports
named in the reports above- hxxps://api.telegram[.]org/botin 1 report
Copy this indicator · defanged
Thanks — we review every report.