iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Cisco Talos assessed that YoroTrooper likely included people from Kazakhstan, but the available reporting does not establish that the group was a Kazakh government unit. The attribution rests on operational clues—including language and currency use and apparent interest in a Kazakh state-owned email service—while Talos also reported activity designed to make operations appear Azerbaijani. YoroTrooper is best understood as an espionage-focused actor whose operators’ identity and sponsorship remain unresolved.
What YoroTrooper is
YoroTrooper is the name used by Cisco Talos for an espionage-focused threat actor that Talos traced to activity beginning in June 2022. Talos associated its operations with intelligence gathering and data theft. Its 2023 year-in-review describes a mix of self-developed and commodity malware, including AveMaria/Warzone RAT and LodaRAT. These examples show varied tooling; they do not mean every campaign used every tool. Cisco Talos’s 2023 year-in-review
ESET uses “SturgeonPhisher” as another name for YoroTrooper in its Q4 2023–Q1 2024 activity report. Treat that as ESET’s naming rather than assuming that every vendor’s label for a threat actor refers to the same group. ESET’s activity report
Why Talos linked the group to Kazakhstan
Talos assessed with high confidence that YoroTrooper likely consisted, at least in part, of people from Kazakhstan. Reporting describes several clues behind that assessment: use of Kazakh and Russian, activity involving Kazakhstani currency, and apparent attention to a state-owned Kazakh email service. Those indicators support an analytic judgment about likely ties; they do not independently prove an operator’s citizenship, the group’s command structure, or government control. Recorded Future News’s account of the Talos findings; SecurityWeek’s coverage
#1 Best Overall
What the assessment does—and does not—say
- Supported: Talos judged that the activity likely had a Kazakhstan connection based on operational clues.
- Not established: The reporting does not prove that the operators were all Kazakh, that Kazakhstan directed the activity, or that the group acted as an official state unit.
Talos described possible explanations that included alignment with Kazakh state interests or government direction, but also a financial motive involving the sale of restricted information. The available reporting does not resolve which explanation, if any, accounts for the activity. SecurityWeek’s account of the attribution discussion
Why Azerbaijan appears in the reporting
Azerbaijan features both as a reported target and in Talos’s account of efforts to make YoroTrooper’s activity look Azerbaijani. Talos reported the use of infrastructure or other means that could create that appearance, a tactic intended to mislead attribution. An apparent infrastructure location is not the same as the operators’ origin: it does not establish that the people behind the activity were Azerbaijani. Recorded Future News’s reporting on the Azerbaijan indicators
Reported targets and activity timeline
Talos places YoroTrooper’s emergence in June 2022. Its March 2023 disclosure described compromises involving a European Union healthcare agency and the World Intellectual Property Organization (WIPO), as well as activity against organizations in Commonwealth of Independent States (CIS) countries. In October 2023 reporting, Talos said the actor had expanded its tools and tactics since the initial disclosure. Recorded Future News’s coverage of the Talos disclosures
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Talos’s year-in-review describes operations against government and energy organizations in Azerbaijan, Tajikistan, Kyrgyzstan and other CIS countries, alongside strategic government targets in Europe and Turkey. It also reports compromised accounts at the EU healthcare agency and WIPO. This is a set of reported examples, not a complete victim list. Cisco Talos’s 2023 year-in-review
Rank #3
ESET’s later report says the group mainly targeted Central Asian governments and describes activity involving the Iranian and Yemeni foreign ministries in late 2023. Those details reflect ESET’s reporting and the period covered by its report. ESET’s Q4 2023–Q1 2024 activity report
Methods and tools attributed to YoroTrooper
Contemporaneous coverage of Talos findings describes spear-phishing and credential theft, as well as the use of known vulnerabilities and VPN accounts in reported activity. The collection Talos described included credentials, browser histories, system information and screenshots. These are observed examples across activity, not a checklist that applies to every victim or intrusion. SecurityWeek’s coverage of the Talos findings
The reported toolset changed over time. Examples include custom Python implants later ported to PowerShell, a Windows executable interactive reverse shell, and Rust- and Go-based implementations. Talos’s year-in-review also records use of commodity malware alongside tools attributed as self-developed, so the group should not be characterized as relying exclusively on custom software. SecurityWeek’s tool coverage; Cisco Talos’s year-in-review
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhat is known about its current status
The cited reporting documents activity through the periods covered by Talos’s 2023 publications and ESET’s Q4 2023–Q1 2024 report. It does not establish whether YoroTrooper remains active as of October 2026, so those older findings should not be read as confirmation of current operations.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
