YoroTrooper APT group targets CIS countries and embassies

A new APT group, dubbed YoroTrooper, has been targeting government and energy organizations across Europe, experts warn.

Cisco Talos researchers uncovered a new cyber espionage group targeting CIS countries, embassies and EU health care agency since at least June 2022.

The APT group focuses on government or energy organizations in Azerbaijan, Tajikistan, Kyrgyzstan and other Commonwealth of Independent States (CIS). The experts reported that the group hacked accounts from at least two international organizations, a critical EU health care agency and the World Intellectual Property Organization (WIPO). Talos reported that the threat actor also likely targets other organizations across Europe and Turkish (Türkiye) government agencies.

Data stolen by the threat actors includes credentials from multiple applications, browser histories and cookies, system information and screenshots.

YoroTrooper’s arsenal includes Python-based, custom-built and open-source information stealers, such as the Stink stealer wrapped into executables via the Nuitka framework and PyInstaller. The group also employed commodity malware in its campaign, such as AveMaria/Warzone RAT, LodaRAT and Meterpreter.

The attack vectors are phishing emails with an attached archive containing two files, a shortcut file and a decoy PDF file.

The malicious LNK files acts as downloaders that uses mshta.exe to download and execute a remote HTA file on the infected endpoint.

“The malicious HTA files employed in this campaign have seen a steady evolution with the latest variant downloading the next-stage payload: a malicious EXE-based dropper and a decoy document. All these tasks are accomplished by running PowerShell-based commands.” continues Talos.

Talos states that there are some similarities in their TTPs and victimology between PoetRAT and YoroTrooper groups.

Some evidence collected by the experts suggests the threat actor is Russian-speaking, such as the presence of telegram messages in Russian and Cyrillic snippets in the source code of the malware used by the actor.

“YoroTrooper has been consistently introducing new malware into their infection chains in this campaign, including both custom-built and commodity malware. It is worth noting that while this campaign began with the distribution of commodity malware such as AveMaria and LodaRAT, it has evolved significantly to include Python-based malware.” concludes the report that also includes Indicators of Compromise (IoCs). “This highlights an increase in the efforts the threat actor is putting in, likely derived from successful breaches during the course of the campaign.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, YoroTrooper)