Threat Research · blog.talosintelligence.com

Talos Details YoroTrooper Espionage Campaigns Targeting CIS Governments, Embassies and EU Health Agency

Mar 14, 2023 · Original article ↗

Summary

Talos details YoroTrooper espionage campaigns active since June 2022, targeting CIS governments and other organizations. The actor used phishing, custom and commodity malware to steal credentials, browser data, screenshots and documents.

Key points

Talos links three activity clusters to YoroTrooper, which has targeted governments and energy organizations across CIS countries, as well as embassies and international organizations.
Talos found stolen credentials from accounts at an EU health care agency and WIPO, and reports compromised embassies of Azerbaijan and Turkmenistan.
Phishing emails delivered RAR or ZIP archives containing malicious LNK shortcuts, sometimes with decoy documents. Shortcuts launched HTA downloaders and subsequent payloads.
The toolset included custom Python stealers and RATs, Stink stealer, AveMaria/Warzone RAT, LodaRAT and Meterpreter; some implants used Telegram bots for commands or data exfiltration.
Stolen information included application credentials, browser histories and cookies, screenshots, system details and documents.
Talos assesses the actor may be Russian-speaking but found insufficient evidence to link YoroTrooper to the PoetRAT team; LodaRAT use alone does not establish attribution to Kasablanka.

Article Details

Attack Vectors: Phishing emails deliver malicious archives containing LNK shortcut files and, sometimes, decoy documents.
LNK files use mshta.exe to download and execute remote HTA files; HTAs use PowerShell commands to retrieve and run subsequent payloads.
Typo-squatted and attacker-registered domains host malicious artifacts and imitate legitimate CIS government and organization domains.
Some campaigns use VHDX files containing archives and LNKs, or LNK files that download implants directly using curl.
Payloads include credential stealers, RATs, reverse shells, and a keylogger.
Defensive Notes: The article recommends blocking malicious emails, websites, domains, IPs, and URLs, and detecting or blocking the associated malware and activity using Cisco security products and Snort rules.
Cisco Duo multi-factor authentication is cited as a measure to help ensure only authorized users access the network.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`account[.]nail[.]ru[.]inro[.]link`	Malicious subdomain masquerading as a Russian entity in the September 2022 campaign.
DOMAIN	`akipress[.]news`	Typosquatted malicious domain used to imitate AKI Press News Agency.
DOMAIN	`belaes[.]by[.]authentication[.]becloud[.]cc`	Malicious subdomain identified as attacker infrastructure impersonating Belarusian Nuclear Power Plant.
DOMAIN	`belstat[.]gov[.]by[.]attachment-posts[.]cc`	Malicious subdomain identified as attacker infrastructure impersonating Belarus’s National Statistical Committee.
DOMAIN	`industry[.]tj[.]mypolicy[.]top`	Malicious subdomain identified as attacker-registered infrastructure impersonating Tajikistan’s Ministry of Industry and New Technologies.
DOMAIN	`mail[.]belaes[.]by[.]authentication[.]becloud[.]cc`	Malicious domain masquerading as a Belarusian domain in the October 2022 campaign.
DOMAIN	`mail[.]hse[.]ru[.]attachment-posts[.]cc`	Malicious subdomain masquerading as a Russian domain in the August 2022 campaign.
DOMAIN	`mail[.]mfa[.]az-link[.]email`	Malicious domain used in the campaign to impersonate Azerbaijan’s Ministry of Foreign Affairs.
DOMAIN	`mail[.]mfa[.]gov[.]kg[.]openingfile[.]net`	Malicious subdomain identified as attacker-registered infrastructure impersonating Kyrgyzstan’s Ministry of Foreign Affairs.
DOMAIN	`maileecommission[.]inro[.]link`	Malicious domain impersonating European Commission email infrastructure.
DOMAIN	`minsk[.]gov[.]by[.]attachment-posts[.]cc`	Malicious subdomain identified as attacker infrastructure impersonating the Government of Minsk.
DOMAIN	`rnail[.]iterrf[.]ru[.]inro[.]link`	Malicious subdomain masquerading as a Russian government entity in the September 2022 campaign.
DOMAIN	`rnail[.]mintrans[.]gov[.]ru[.]inro[.]link`	Malicious subdomain masquerading as a Russian government entity in the September 2022 campaign.
DOMAIN	`rnail[.]rnid[.]ru[.]inro[.]link`	Malicious subdomain masquerading as a Russian government entity in the September 2022 campaign.
DOMAIN	`sts[.]mfa[.]gov[.]tr[.]mypolicy[.]top`	Malicious subdomain identified as attacker-registered infrastructure impersonating Turkey’s Ministry of Foreign Affairs.
DOMAIN	`true[.]az-link[.]email`	Malicious domain used in the campaign targeting Azerbaijan.