YoroTrooper
Also known as Salted Earth, Sturgeon Fisher, ShadowSilk, Silent Lynx, Cavalry Werewolf, SturgeonPhisher, Comrade Saiga
YoroTrooper’s main targets are government or energy organizations in Azerbaijan, Tajikistan, Kyrgyzstan and other Commonwealth of Independent States, based on Cisco Talos analysis. YoroTrooper was also observed compromising accounts from at least two international organizations: a critical European Union health care agency and the World Intellectual Property Organization. Successful compromises also included Embassies of European countries including Azerbaijan and Turkmenistan.
Targets: Germany
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
Recent activity
No posts or advisories have named this actor recently.
References
- https://blog.talosintelligence.com/attributing-yorotrooper/
- https://blog.talosintelligence.com/yorotrooper-espionage-campaign-cis-turkey-europe/
- https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Cyber-Sicherheitslage/Analysen-und-Prognosen/Threat-Intelligence/Aktive_APT-Gruppen/aktive-apt-gruppen_node.html
- https://www.group-ib.com/blog/shadowsilk/
- https://www.seqrite.com/blog/silent-lynx-apt-targeting-central-asian-entities/
- https://bi-zone.medium.com/cavalry-werewolf-raids-russias-public-sector-with-trusted-relationship-attacks-e19f7a5c83ef
- https://www.seqrite.com/blog/operation-peek-a-baku-silent-lynx-apt-dushanbe-espionage/
- https://ctoatncsc.substack.com/p/cto-at-ncsc-summary-week-ending-october
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.