YoroTrooper

YoroTrooper is an espionage-focused threat actor active since at least June 2022 that has targeted government, diplomatic, energy, mining, manufacturing, and related organizations across the CIS and parts of Europe. The group is also associated with the aliases Tomiris and Silent Lynx, and reporting has noted overlaps with clusters tracked as Cavalry Werewolf, SturgeonPhisher, Comrade Saiga, and ShadowSilk. Available reporting supports a likely Kazakhstan nexus, while some analysis also indicates the operators are likely Russian-language speakers. The actor has primarily targeted organizations in Azerbaijan, Tajikistan, Kyrgyzstan, Russia, Belarus, and other Eurasian Economic Union or CIS states, with additional victimology including European diplomatic entities, a critical European Union health care agency, the World Intellectual Property Organization, and likely Turkish government targets. In 2025, the group was observed targeting Russia’s public sector as well as energy, manufacturing, and mining enterprises. YoroTrooper commonly gains initial access through targeted phishing. Typical delivery chains use archives containing malicious shortcut files alongside decoy documents, with lures impersonating government or diplomatic entities. Subsequent execution chains have used mshta and HTA content, PowerShell-based downloaders, and direct retrieval of follow-on payloads. The actor has also used cloud and consumer platforms as operational infrastructure, notably Telegram bots and the Discord API as command-and-control channels and for data exfiltration. Its tooling combines custom malware and commodity implants. Reported malware and tooling associated with the actor include FoalShell, StallionRAT, Python reverse shells, Meterpreter, AveMaria or Warzone RAT, LodaRAT, and open-source stealers such as Stink. Python payloads have been packaged into executables using Nuitka and PyInstaller. A custom keylogger has also been documented. FoalShell and StallionRAT support remote command execution, while StallionRAT additionally supports file loading and exfiltration through Telegram. Reverse proxy tooling has also been used to support post-compromise access. Observed objectives and collection behavior are consistent with cyberespionage. YoroTrooper has stolen application credentials, browser histories and cookies, system information, screenshots, and documents of interest, and has attempted to deploy additional malware after compromising diplomatic environments. The group’s tradecraft emphasizes low-cost, flexible tooling, phishing-led access, cloud-service abuse for command and control, and modular post-compromise collection across government and strategic-sector targets.