YoroTrooper Uses Phishing and Custom Malware While Disguising Its Origins as Azerbaijani
Summary
Talos links YoroTrooper to likely Kazakhstan-based operators who disguise activity as Azerbaijani and target CIS governments. The group uses credential-harvesting phishing, compromised websites, and evolving custom implants across several programming languages.
Key points
- Talos assesses with high confidence that YoroTrooper operators are likely based in Kazakhstan, citing language use, currency activity, and limited targeting of Kazakh entities.
- The group routes much of its activity through Azerbaijan and uses translated lures and local VPN exit nodes to obscure its origin.
- From May to August 2023, YoroTrooper compromised government-related websites and accounts in Tajikistan, Kyrgyzstan, and Uzbekistan, including exfiltrating 165 MB of documents from a Tajiki victim.
- Spearphishing links victims to credential-harvesting pages; the group also uses vulnerability scanners and services such as Shodan to identify targets.
- The malware toolkit has shifted toward custom implants, including reverse shells and Python RAT variants ported to PowerShell, Go, and Rust.
- Some compromised state-owned websites were used to host malware payloads; Talos reported that some remained available as of September 2023.
Article Details
- Attack Vectors
- YoroTrooper sends spearphishing messages directing victims to attacker-controlled credential-harvesting pages.
- The operators use compromised government websites to host malware payloads and use decoy documents to support delivery.
- The article describes Python RATs ported to PowerShell and GoLang, custom reverse shells, and Rust-based implants.
- Some implants collect data and exfiltrate it through Telegram channels; a Chrome credential stealer is also reported.
- Defensive Notes
- Cisco recommends blocking malicious emails, websites, domains, IPs, and URLs, and detecting or preventing execution of the malware described.
- Cisco recommends using multi-factor authentication and keeping Snort Subscriber Rule Set rules up to date.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | mail[.]ady[.]az[.]logiin[.]email | Attacker-hosted credential-harvesting page identified in YoroTrooper's phishing-page files. |
| DOMAIN | mail[.]antikor[.]gov[.]kz[.]openingfile[.]net | Attacker-created malicious subdomain used to spoof Kazakhstan's Anti-Corruption Agency domain. |
| DOMAIN | mail[.]economy[.]qov[.]az-link[.]email | Malicious subdomain YoroTrooper used in phishing operations targeting entities in Azerbaijan. |
| DOMAIN | mail[.]gov[.]az-link[.]email | Malicious subdomain YoroTrooper used in phishing operations targeting entities in Azerbaijan. |
| DOMAIN | mail[.]mfa[.]az-link[.]email | Malicious subdomain YoroTrooper used in phishing operations targeting entities in Azerbaijan. |
| DOMAIN | mail[.]mincom[.]gov-az[.]site | Credential-harvesting page identified in YoroTrooper's phishing-page files. |
| DOMAIN | mail[.]socar[.]az[.]logiin[.]email | Attacker-hosted credential-harvesting page identified in YoroTrooper's phishing-page files. |
| DOMAIN | remote[.]mfa[.]gov[.]az | Credential-harvesting page identified in YoroTrooper's phishing-page files. |
| DOMAIN | ru[.]auth[.]logiin[.]email | Attacker-hosted credential-harvesting page identified in YoroTrooper's phishing-page files. |
| IPV4 | 168[.]100[.]8[.]21 | IP address listed as YoroTrooper network infrastructure. |
| IPV4 | 168[.]100[.]8[.]242 | YoroTrooper-controlled infrastructure used to host a domain for targeting entities in Azerbaijan. |
| IPV4 | 46[.]161[.]27[.]151 | IP address listed as YoroTrooper network infrastructure. |
| SHA256 | 0a9908d8c4de050149883ca17625bbe97830ba61c3fe6b0ef704c65361027add | Hash of an executable listed as a YoroTrooper IOC. |
| SHA256 | 1828e2df0ad76ea503af7206447e40482669bb25624a60b0f77743cd70f819f6 | Hash of an executable listed as a YoroTrooper IOC. |
| SHA256 | 1e350b316cbc42917f10f6f12fa2a0b8ed2fa6b0159c36141bce18edb6ea7aa0 | Hash of a JavaScript file listed as a YoroTrooper IOC. |
| SHA256 | 30a969fa0492479b1c6ef6d23f8fcccf3d7af35b235d74cab2c0c2fc8c212ad4 | Hash of a JavaScript file listed as a YoroTrooper IOC. |
| SHA256 | 37c369f9a9cac898af2668b1287dea34c753119071a1c447b0bfecd171709340 | Hash of an executable listed as a YoroTrooper IOC. |
| SHA256 | 56fc680799999e38ce84c80e27788839f35ee817816de15b90aa39332fcc5aee | Hash of a PowerShell script listed as a YoroTrooper IOC. |
| SHA256 | 57d0336c0dbaf455229d2689bf82f9678eb519e017d40ba60a6d6b90f87321f8 | Hash of a JavaScript file listed as a YoroTrooper IOC. |
| SHA256 | 5a6b089b1d2dd66948f24ed2d9464ce61942c19e98922dd77d36427f6cded634 | Hash of a PowerShell script listed as a YoroTrooper IOC. |
| SHA256 | 8131bd594aff4f4e233ac802799df3422f423dc28e96646a09a2656563c4ad7c | Hash of an archive listed as a YoroTrooper IOC. |
| SHA256 | 832d58d9e067730a5705c8c307fd51c044d9697911043be9564593e05216e82a | Hash of a JavaScript file listed as a YoroTrooper IOC. |
| SHA256 | 8921c20539fc019a9127285ca43b35610f8ecb0151872cdd50acdaa12c23722d | Hash of an executable listed as a YoroTrooper IOC. |
| SHA256 | 93829ee93688a31f90572316ecb21702eab04886c8899c0a59deda3b2f96c4be | Hash of an executable listed as a YoroTrooper IOC. |
| SHA256 | 941be28004afc2c7c8248a86b5857a35ab303beb33c704640852741b925558a1 | Hash of an executable listed as a YoroTrooper IOC. |
| SHA256 | 9b81c5811ef3742cd4f45b6c3ba1ace70a0ce661acc42d974beaeddf307dd53d | Hash of an HTA file listed as a YoroTrooper IOC. |
| SHA256 | a25db1457cf6b52be481929755dd9699ed8d009aa30295b2bf54710cb07a2f22 | Hash of a PowerShell script listed as a YoroTrooper IOC. |
| SHA256 | a3b1c3faa287f6ba2f307af954bb2503b787ae2cd59ec65e0bdd7a0595ea8c7e | Hash of an archive listed as a YoroTrooper IOC. |
| SHA256 | a5d8924f7f285f907e7e394635f31564a371dd58fad8fc621bacd5a55ca5929b | Hash of a JavaScript file listed as a YoroTrooper IOC. |
| SHA256 | ab6a8718dffbe48fd8b3a74f4bcb241cde281acf9e378b0c2370a040e4d827da | Hash of a JavaScript file listed as a YoroTrooper IOC. |
| SHA256 | b4eac90e866f5ad8af37b43f5e9459e59ee1e7e2cbb284703c0ef7b1a13ee723 | Hash of an executable listed as a YoroTrooper IOC. |
| SHA256 | b6a5d6696cbb1690f75b0d9a42df8cefd444cfd3749be474535948a70ff2efd2 | Hash of an HTA file listed as a YoroTrooper IOC. |
| SHA256 | da75326cfebcca12c01e4a51ef77547465e03316c5f6fbce901ddcfe6425b753 | Hash of a JavaScript file listed as a YoroTrooper IOC. |
| SHA256 | e0c7479e36b20cd7c3ca85966968b258b1148eb645a544230062ec5dff563258 | Hash of an HTA file listed as a YoroTrooper IOC. |
| SHA256 | e95e64e7ba4ef18df0282df15fc97cc76ba57ea250a0df51469337f561cc67d3 | Hash of a JavaScript file listed as a YoroTrooper IOC. |
| SHA256 | ed8c04a3e2d95d5ad8e2327a56d221715f06ed84eb9dc44ff86acff4076629d7 | Hash of an LNK file listed as a YoroTrooper IOC. |
| SHA256 | f55b41ca475f411af10eaf082754c6e8b7a648da4fa72c23cbfea9fa13a91d88 | Hash of an HTA file listed as a YoroTrooper IOC. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe RATs exfiltrate data through Telegram-based command-and-control channels.T1056.003 · Web Portal CaptureThe phishing pages capture victims' credentials.T1059.001 · PowerShellThe actor runs ported PowerShell implants and scripts for commands and file exfiltration.T1059.003 · Windows Command ShellCustom reverse shells run commands on infected Windows endpoints through cmd.exe.T1105 · Ingress Tool TransferA PyInstaller-wrapped executable downloads an implant from an attacker-controlled server.T1555.003 · Credentials from Web BrowsersThe article reports a PyInstaller-wrapped Python stealer used to collect Google Chrome credentials.T1566.002 · Spearphishing LinkYoroTrooper sends spearphishing messages that direct victims to credential-harvesting pages.T1593 · Search Open Websites/DomainsYoroTrooper searches public websites and infrastructure using Google, Shodan, and Censys to identify targets and exposed information.T1595.002 · Vulnerability ScanningThe operators use vulnerability scanners, including Acunetix, to find weaknesses in target infrastructure.
People
Threat Actors
Vendors
Products
Google Chrome• Reused a PyInstaller-wrapped, Python-based Google Chrome credential stealer that was first seen in January 2023, though this version did not include an upload capability.NordVPNas VPN accounts. For example, in 2022, the actors used this email address to obtain a subscription to NordVPN, valid from 2022 to 2025, from darkstore[.]su:Telegram• Deployed PowerShell-based implants and used Telegram APIs.
Tools
AcunetixYoroTrooper consistently relies on vulnerability scanners such as Acunetix and open-source data from search engines such as Shodan to locate and infiltrate a target’s infrastructure.Censysof infrastructure they are interested in targeting, using search engines such as Google, Shodan and Censys to find vulnerabilities and leakages in a target's infrastructure. This research includes searching forNuitkacustom-built Python implants that were previously packaged into executables using frameworks such as Nuitka and PyInstaller, to PowerShell scripts that are now directly run from the central HTA script.PyInstaller• Reused a PyInstaller-wrapped, Python-based Google Chrome credential stealer that was first seen in January 2023, though this version did not include an upload capability.ShodanFor example, YoroTrooper queried IP address 168[.]100[.]8[.]242 on Shodan, which hosted domain mail[.]asco[.]az-link[.]email on July 11, 2022 that was used by YoroTrooper to target entities in Azerbaijan in November
Countries
AzerbaijanKazakhstan-associated YoroTrooper disguises origin of attacks as AzerbaijanKazakhstanKazakhstan-associated YoroTrooper disguises origin of attacks as AzerbaijanKyrgyzstanunder the President of the Republic of Tajikistan, as well as kyrgyzkomur[.]gov[.]kg, which belongs to Kyrgyzstan's state-owned coal enterprise.YoroTrooper also compromised a user from the Ministry of Transport andTajikistanThe first website compromised in May 2023 was tpp[.]tj, which is managed by the country’s Chamber of Commerce and Industry of the Republic of Tajikistan.Uzbekistan