Threat Actor 🇰🇿 Kazakhstan

YoroTrooper

Also known as: Salted Earth · Sturgeon Fisher · ShadowSilk · Silent Lynx · Cavalry Werewolf · SturgeonPhisher · Comrade Saiga

YoroTrooper’s main targets are government or energy organizations in Azerbaijan, Tajikistan, Kyrgyzstan and other Commonwealth of Independent States, based on Cisco Talos analysis. YoroTrooper was also observed compromising accounts from at least two international organizations: a critical European Union health care agency and the World Intellectual Property Organization. Successful compromises also included Embassies of European countries including Azerbaijan and Turkmenistan.

Indicators of Compromise 56

Filename rev.exe Filename revv2.exe Filename win.exe Filename Аппарат Правительства Российской Федерации по вопросу отнесения реализуемых на территории Сибирского федерального округа.exe Filename Информация по письму в МИД от 6 июля статус и прилагаемые документы.exe Filename О ПРЕДОСТАВЛЕНИИ ИНФОРМАЦИИ ДЛЯ ПОДГОТОВКИ СОВЕЩАНИЯ.exe Filename О проведении личного приема граждан список участников.exe Filename О работе почтового сервера план и проведенная работа.exe Filename О результатах трёх месяцев совместной работы [redacted].exe Filename План-протокол встречи о сотрудничестве представителей должн.лиц.exe Filename Приказ о поощрении сотрудников ко дню России (Т-11а) № 1 от 30.05.2025.exe Filename Программный офис Управления Организации Объединенных Наций по наркотикам и преступности (УНП ООН).exe Filename Службеная записка от 16.06.2025___________________________.exe Filename Служебная записка от 12.08.2025[multiple spaces].exe Filename Служебная записка от 20.08.2025[multiple spaces].exe Filename Список сотрудников выдвинутых к премии ко Дню России.exe.exe SHA-256 04769b75d7fb42fbbce39d4c4b0e9f83b60cc330efa477927e68b9bdba279bb8 SHA-256 0e7b65930bc73636f2f99b05a3bb0af9aaf17d3790d0107eb06992d25e62f59d SHA-256 148a42ccaa97c2e2352dbb207f07932141d5290d4c3b57f61a780f9168783eda SHA-256 1dfe65e8dc80c59000d92457ff7053c07f272571a8920dbe8fc5c2e7037a6c98 SHA-256 22ba8c24f1aefc864490f70f503f709d2d980b9bc18fece4187152a1d9ca5fab SHA-256 27a11c59072a6c2f57147724e04c7d6884b52921da2629fb0807e0bb93901cbc SHA-256 3cd7f621052919e937d9a2fdd4827fc7f82c0319379c46d4f9b9dd5861369ffc SHA-256 4f17a7f8d2cec5c2206c3cba92967b4b499f0d223748d3b34f9ec4981461d288 SHA-256 6b290953441b1c53f63f98863aae75bd8ea32996ab07976e498bad111d535252 SHA-256 7084f06f2d8613dfe418b242c43060ae578e7166ce5aeed2904a8327cd98dbdf SHA-256 7da82e14fb483a680a623b0ef69bcfbd9aaaedf3ec26f4c34922d6923159f52f SHA-256 8404f8294b14d61ff712b60e92b7310e50816c24b38a00fcc3da1371a3367103 SHA-256 8e6d7c44ab66f37bf24351323dc5e8d913173425b14750a50a2cbea6d9e439ba SHA-256 8e7fb9f6acfb9b08fb424ff5772c46011a92d80191e7736010380443a46e695c SHA-256 a3ec2992e6416a3af54b3aca3417cf4a109866a07df7b5ec0ace7bd1bf73f3c6 SHA-256 a8ada7532ace3d72e98d1e3c3e02d1bd1538a4c5e78ce64b2fe1562047ba4e52 SHA-256 ab0ad77a341b12cfc719d10e0fc45a6613f41b2b3f6ea963ee6572cf02b41f4d SHA-256 af3d740c5b09c9a6237d5d54d78b5227cdaf60be89f48284b3386a3aadeb0283 SHA-256 b13b83b515ce60a61c721afd0aeb7d5027e3671494d6944b34b83a5ab1e2d9f4 SHA-256 c26b62fa593d6e713f1f2ccd987ef09fe8a3e691c40eb1c3f19dd57f896d9f59 SHA-256 c3df16cce916f1855476a2d1c4f0946fa62c2021d1016da1dc524f4389a3b6fa SHA-256 c9ffbe942a0b0182e0cd9178ac4fbf8334cae48607748d978abf47bd35104051 SHA-256 cc84bfdb6e996b67d8bc812cf08674e8eca6906b53c98df195ed99ac5ec14a06 SHA-256 cc9e5d8f0b30c0aaeb427b1511004e0e4e89416d8416478144d76aa1777d1554 SHA-256 dae3c08fa3df76f54b6bae837d5abdc309a24007e9e6132a940721045e65d2bb SHA-256 e15f1a6d24b833ab05128b4b34495ef1471bd616b9833815e2e98b8d3ae78ff2 SHA-256 ec80e96e3d15a215d59d1095134e7131114f669ebc406c6ea1a709003d3f6f17 SHA-256 fa6cdd1873fba54764c52c64eadca49d52e5b79740364ef16e5d86d61538878d SHA-256 fbf1bae3c576a6fcfa86db7c36a06c2530423d487441ad2c684cfeda5cd19685 IP 109[.]172[.]85[.]95 IP 185[.]173[.]37[.]67 IP 185[.]231[.]155[.]111 IP 185[.]244[.]180[.]169 IP 188[.]127[.]225[.]191 IP 188[.]127[.]227[.]226 IP 62[.]113[.]114[.]209 IP 78[.]128[.]112[.]209 IP 91[.]219[.]148[.]93 IP 94[.]198[.]52[.]200 IP 96[.]9[.]125[.]168

MITRE ATT&CK TTPs 13

T1027
Obfuscated Files or Information
Defense Evasion
 T1027.005
Indicator Removal from Tools
Defense Evasion
 T1059.001
PowerShell
Execution
 T1059.003
Windows Command Shell
Execution
 T1069.002
Domain Groups
Discovery
 T1070.006
Timestomp
Defense Evasion
 T1083
File and Directory Discovery
Discovery
 T1087.002
Domain Account
Discovery
 T1140
Deobfuscate/Decode Files or Information
Defense Evasion
 T1204.002
Malicious File
Execution
 T1547.001
Registry Run Keys / Startup Folder
Persistence
 T1566
Phishing
Initial Access
 T1566.001
Spearphishing Attachment
Initial Access

Source Articles

Cavalry Werewolf raids Russia’s public sector with trusted relationship attacks | Learn more
Cavalry Werewolf conducted targeted phishing campaigns from May to August 2025, primarily against Russian public sector entities and critical infrastructure organizations. The attackers impersonated Kyrgyz government officials and delivered custom malware, including FoalShell reverse shells and StallionRAT, via malicious RAR attachments. These tools enabled remote command execution, data exfiltration, and persistence through registry modifications, with command and control communications routed through Telegram bots and proxy tools.
static-urls