YoroTrooper

YoroTrooper is an espionage-focused threat actor active since at least June 2022 that has targeted government, diplomatic, energy, mining, manufacturing, and other public-sector or strategic organizations across the CIS and adjacent regions, with observed victimology including Azerbaijan, Tajikistan, Kyrgyzstan, Russia, other Eurasian Economic Union member states, and selected European entities. Reported compromises have included diplomatic missions and accounts associated with international organizations, indicating an interest in government and intergovernmental intelligence collection. The group is widely associated with the aliases Tomiris and Silent Lynx, and overlap has also been reported with activity tracked as Cavalry Werewolf, SturgeonPhisher, Comrade Saiga, and ShadowSilk. Some reporting assesses the actor or a closely related cluster as likely Kazakhstan-based or Kazakhstan-affiliated, although such attribution remains an assessment rather than a universally established fact. YoroTrooper commonly gains initial access through targeted phishing, often using archives containing malicious shortcut files and decoy documents, as well as phishing pages and cloud-hosted malware delivery. The actor has impersonated government and institutional entities to increase lure credibility. Its execution chains have used LOLBins and script-based downloaders, including mshta and PowerShell, to retrieve and launch follow-on payloads. The actor employs a mixture of custom and commodity malware. Observed tooling includes Python-based custom implants and stealers, lightweight reverse shells, remote-access trojans, Meterpreter, and malware families such as AveMaria (Warzone RAT), LodaRAT, FoalShell, and StallionRAT. Python payloads have been packaged into Windows executables using common bundling frameworks. Some operations have also used burner RATs and reverse-proxy tooling to support short-lived access, lateral movement, and operator flexibility. Command-and-control tradecraft prominently includes abuse of legitimate cloud and messaging platforms. YoroTrooper has used Telegram bots and the Discord API as operational C2 channels for backdoors, tasking, and data exfiltration. This reliance on trusted services helps the actor blend malicious traffic with normal user activity and complicates network-based detection. Post-compromise objectives center on intelligence collection and follow-on access. Reported collection includes application credentials, browser data, host information, screenshots, and documents of interest. The actor has also deployed additional malware after initial compromise and used remote command execution to expand control over victim environments. Operationally, YoroTrooper is characterized by pragmatic reuse of open-source and commodity tooling alongside custom malware, targeted spearphishing, selective victim validation, and sustained espionage against state and strategic-sector targets. Researchers have noted similarities in victimology and tradecraft with PoetRAT, but publicly available evidence has been described as insufficient for a confident linkage. Overall, YoroTrooper is best understood as a CIS-focused espionage actor that combines social engineering, living-off-the-land execution, and cloud-service-backed C2 to support credential theft, surveillance, and data exfiltration.