YoroTrooper

Profile narrative

YoroTrooper is a threat actor tracked under that alias and, according to the provided context, is associated with Russia as its known location. The group has been active since at least June 2022 and primarily conducts espionage operations against government and energy organizations in Commonwealth of Independent States countries such as Azerbaijan, Tajikistan and Kyrgyzstan, while also targeting embassies of European nations including Azerbaijan and Turkmenistan and compromising accounts at the World Intellectual Property Organization and a European Union health care agency. Their strategic objective is the collection of sensitive information for intelligence purposes, as evidenced by the exfiltration of credentials, browser histories, cookies, system data and screenshots that can support lateral movement or future phishing efforts. Initial access is achieved through phishing emails that deliver malicious archives containing shortcut files (LNKs) and decoy documents, with the LNKs triggering the download of a remote HTA file that leads to the execution of subsequent payloads. The actor’s toolbox includes Python‑based custom information stealers and remote access trojans that are often packaged with Nuitka or PyInstaller, commodity malware families such as AveMaria/Warzone RAT, LodaRAT and the Stink stealer, as well as Meterpreter binaries and custom C‑based keyloggers for reverse shell capabilities. Communication and data exfiltration are frequently handled via Telegram bots, with some implants containing Russian language strings and code that decodes command output using Cyrillic code page 866, indicating familiarity with Russian language environments.

Attribution analysis performed by Cisco Talos found no substantial overlap with the Kasablanka group, which is credited with developing LodaRAT, and only weak non‑technical similarities with the PoetRAT team that prevent a confident link despite shared victimology in Azerbaijan’s embassies, energy sector and government institutions and a mutual preference for unusually packed Python‑based implants. The use of LodaRAT by YoroTrooper is not considered a definitive indicator of Kasablanka affiliation because the malware is employed by multiple distinct actors in the threat landscape. Representative operations attributed to YoroTrooper include the June 2022 compromise of the World Intellectual Property Organization and an EU health care agency via phishing‑delivered archives, the subsequent intrusion into Azerbaijani and Turkmen embassies where documents of interest were sought and additional malware deployed, and broader campaigns targeting CIS government and energy entities using the described infection chain and toolset. These activities collectively illustrate a sustained espionage‑focused effort that leverages phishing, custom Python tooling wrapped in common packers, commodity remote access tools and Telegram‑based command‑and‑control to harvest and exfiltrate valuable data from its victims.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 1 source.