YoroTrooper Stealing Credentials and Information from Government and Energy Organizations

Mar 15, 2023Ravie LakshmananCyber Espionage / Data Security

A previously undocumented threat actor dubbed
YoroTrooper has been targeting government, energy,
and international organizations across Europe as part of a cyber
espionage campaign that has been active since at least June
2022.

“Information stolen from successful compromises include
credentials from multiple applications, browser histories and
cookies, system information and screenshots,” Cisco Talos
researchers Asheer Malhotra and Vitor Ventura said^[1]
in a Tuesday analysis.

Prominent countries targeted include Azerbaijan, Tajikistan,
Kyrgyzstan, Turkmenistan, and other Commonwealth of Independent
States (CIS) nations.

The threat actor is believed to be Russian-speaking owing to the
victimology patterns and the presence of Cyrillic snippets in some
of the implants.

That said, the YoroTrooper intrusion set has been found to
exhibit tactical overlaps with the PoetRAT team^[2]
that was documented^[3]
in 2020 as leveraging coronavirus-themed baits to strike government
and energy sectors in Azerbaijan.

YoroTrooper’s data gathering goals are realized through a
combination of commodity and open source stealer malware such as
Ave Maria^[4]
(aka Warzone RAT), LodaRAT^[5], Meterpreter, and
Stink^[6], with the infection
chains using malicious shortcut files (LNKs) and decoy documents
wrapped in ZIP or RAR archives that are propagated via
spear-phishing.

The LNK files function as simple downloaders to execute an
HTA file^[7]
retrieved from a remote server, which is then used to display a
lure PDF document, while stealthily launching a dropper to deliver
a custom stealer that uses Telegram as an exfiltration channel.

The use of LodaRAT is notable as it indicates that the malware
is being employed by multiple operators despite its attribution to
another group called Kasablanka, which has also been observed
distributing Ave Maria^[9]
in recent campaigns targeting Russia.

Other auxiliary tools deployed by YoroTrooper consist of reverse
shells and a C-based custom keylogger that’s capable of recording
keystrokes and saving them to a file on disk.

“It is worth noting that while this campaign began with the
distribution of commodity malware such as Ave Maria and LodaRAT, it
has evolved significantly to include Python-based malware,” the
researchers said.

“This highlights an increase in the efforts the threat actor is
putting in, likely derived from successful breaches during the
course of the campaign.”