YoroTrooper
YoroTrooper is a Kazakhstan-attributed threat actor group with an ideological motive, tracked by Brandefense. It targets 3 sectors, including Government and Finance, in 8 countries, including Canada and Indonesia. It uses 4 MITRE ATT&CK techniques.
- Silent Lynx
- Origin
- Kazakhstan
- Techniques
- 4
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2022
- Record updated
Who They Target.
About YoroTrooper.
YoroTrooper’s main targets are government or energy organizations in Azerbaijan, Tajikistan, Kyrgyzstan and other Commonwealth of Independent States (CIS), based on our analysis. We also observed YoroTrooper compromise accounts from at least two international organizations: a critical European Union (EU) health care agency and the World Intellectual Property Organization (WIPO). Successful compromises also included Embassies of European countries including Azerbaijan and Turkmenistan. We assess the actor also likely targets other organizations across Europe and Turkish (Türkiye) government agencies. Information stolen from successful compromises include credentials from multiple applications, browser histories & cookies, system information and screenshots.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.