Hydra Saiga

Hydra Saiga is a cyberespionage threat actor active since at least 2021, also reported under the names YoroTrooper and ShadowSilk. It targets government, energy, and critical-infrastructure organizations across Central Asia, Europe, and the Middle East. Documented targeting includes the Royal Oman Police and organizations associated with regional water and energy infrastructure. State sponsorship has not been established. The actor obtains initial access through spear-phishing, including messages sent from compromised email accounts, malicious archive attachments, executable loaders disguised as official correspondence, and macro-enabled Word documents. Its tooling combines custom PowerShell, Python, Go, and Rust payloads with publicly available frameworks and utilities such as Havoc, Meterpreter, and resocks. Telegram Bot API communications are a prominent command-and-control mechanism, supporting command retrieval and file transfers. Post-compromise operations are predominantly hands-on-keyboard and rely heavily on legitimate Windows utilities. Hydra Saiga establishes persistence through scheduled tasks and registry modifications; steals credentials through LSASS memory dumping, SAM and SECURITY hive extraction, WDigest configuration changes, fake logon screens, and browser-data stealers; and moves laterally using WMI and PsExec. It disables Microsoft Defender features and Windows Firewall, captures screenshots, archives documents, and exfiltrates data through HTTP uploads and Telegram-based channels. Reconnaissance includes internet-exposure searches and vulnerability scanning. Hydra Saiga and ShadowSilk have shared nearly identical infrastructure. Infrastructure and tooling connections also link the actor to activity associated with Tomiris. Silent Lynx, also tracked as UAT-6275 and TAG-193, has been associated with the broader activity cluster but remains separately tracked because direct indicator and toolset overlap with YoroTrooper has not been established.