- Category
- State · Attributed to a state or working for one.
- Origin
- Kazakhstan(high confidence)
- Motivation
- Information theft and espionage
- Seen
- 2022
- Sources
- 7 sources carry it
- Identifier
- GINC-APT-0264 · yorotrooper
KazakhstanWhat it is
YoroTrooper’s main targets are government or energy organizations in Azerbaijan, Tajikistan, Kyrgyzstan and other Commonwealth of Independent States, based on Cisco Talos analysis. YoroTrooper was also observed compromising accounts from at least two international organizations: a critical European Union health care agency and the World Intellectual Property Organization. Successful compromises also included Embassies of European countries including Azerbaijan and Turkmenistan.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- BI.ZONE
- Cavalry Werewolf
- CrowdStrike
- Silent Lynx
- Other names
- Comrade Saiga, Salted Earth, ShadowSilk, Sturgeon Fisher, SturgeonPhisher
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTKazakhstan
- MISP Galaxy (CFR tagging)Kazakhstan
- ThreatActor.info (Malpedia et al.)Kazakhstan
Targets
- Countries
- Azerbaijan, Germany, Kyrgyzstan, Tajikistan, Turkmenistan, Türkiye
- Sectors
- Energy, Financial, Government
Tools
The tools and malware families the sources tie to it.
- Loda
- Meterpreter
- Stink
- Warzone RAT
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de