Loading threat actor…
YoroTrooper is a cyberespionage threat actor active since at least June 2022, primarily targeting government, diplomatic, and energy-sector organizations across Central Asia and the Commonwealth of Independent States. Names associated with the actor include Comrade Saiga, SturgeonPhisher, ShadowSilk, and Hydra Saiga. Its operations have also compromised accounts associated with a European Union health care agency and the World Intellectual Property Organization. YoroTrooper commonly obtains initial access through spear-phishing emails containing archives with malicious Windows shortcuts and decoy PDF documents. Shortcut execution initiates delivery chains using HTA content and PowerShell to retrieve additional payloads. The actor impersonates regional institutions through typosquatted infrastructure and abuses cloud-based file-sharing services for malware delivery. Its toolkit combines custom Python information stealers and reverse shells with commodity tools, including AveMaria/Warzone RAT, LodaRAT, and Meterpreter. Python payloads are packaged using Nuitka or PyInstaller, while Telegram bots and Discord provide command-and-control channels. Collection includes application credentials, browser histories and cookies, system information, screenshots, and documents. The actor has also deployed a custom C-based keylogger and used Telegram for data exfiltration. Its operators use Russian-language artifacts. Silent Lynx, including activity tracked as UAT-6275 and TAG-193, remains separately tracked from YoroTrooper because direct indicator or toolset overlap has not been established.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
28 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
7 malware families attributed to this actor across reporting.
2 additional families tracked in Mallory.
81 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only as a threat cluster sharing unspecified overlaps with Silent Lynx. The content does not attribute the reported attacks, malware, vulnerabilities, or targeting directly to YoroTrooper.
Suspected of belonging to the same broader activity cluster as Silent Lynx, although no direct indicator or tooling overlaps have been observed. The article explicitly equates Hydra Saiga with Comrade Saiga, an alias of YoroTrooper. Under the Hydra Saiga designation, the actor reportedly compromised at least 34 organizations in eight countries since December 2024 and conducted reconnaissance against more than 200 additional potential targets worldwide. Its operations emphasize water-resource infrastructure in Central Asia and combine custom Rust, Go and Python malware with legitimate system tools.
An overlapping cluster suspected of belonging to the same broader activity cluster as Silent Lynx, without confirmed shared indicators or tooling. The article explicitly equates its Comrade Saiga alias with Hydra Saiga. Under the Hydra Saiga designation, it reportedly compromised at least 34 organizations across eight unspecified countries since December 2024 and conducted reconnaissance against more than 200 additional targets worldwide. It emphasizes water-resource infrastructure in Central Asia and uses custom Rust, Go, and Python implants.
Suspected Kazakhstan-based cyber-espionage actor that emerged in 2022 and primarily targets governments in Central Asia and neighboring countries. Earlier campaigns linked to it overlap with UAT-6275 operations; the content does not establish that the two names identify the same group.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.