Full Report
This blog describes attacks on victims in Central Asia and APAC. Research into the attack has identified a group also called YoroTrooper. We also identified profiles of attackers on hacker forums, their malicious web-panels, test infections of attackers' own machines, and screenshots of attackers' desktops.
Analysis Summary
# Threat Actor: YoroTrooper
## Attribution & Identity
* **Name:** YoroTrooper
* **Aliases/Associated Groups:** ShadowSilk (referenced in relation to scheduled tasks).
* **Identity Details:** The actor has been identified through profiles on hacker forums, malicious web-panels, and operational security (OPSEC) failures where researchers observed screenshots of the attackers' own desktops and test infections on their own machines.
## Activity Summary
YoroTrooper is an espionage-oriented threat actor active since at least 2022. The group specializes in credential theft and information exfiltration. Recent campaigns have focused on targets in Central Asia and the Asia-Pacific (APAC) region. They utilize a mix of custom Telegram-based malware, commodity webshells, and well-known offensive security frameworks like Cobalt Strike and Metasploit.
## Tactics, Techniques & Procedures
The actor employs a variety of techniques across the kill chain, focusing on data collection and persistent access:
* **Initial Access & Execution:**
* Command and Scripting Interpreter: PowerShell (**T1059.001**) – Used for downloading payloads and executing C2 commands.
* **Persistence:**
* Registry Run Keys / Startup Folder (**T1547.001**).
* Web Shells (**T1505.003**) – Utilization of Godzilla and Behinder webshells.
* Scheduled Tasks (**T1053.005**) – Used to launch payloads at specific intervals.
* **Privilege Escalation & Discovery:**
* Access Token Manipulation (**T1134**).
* Use of **PEASS-ng** for privilege escalation and persistence identification.
* Network/System Discovery using **Fscan**, **Meterpreter**, and native commands (*ipconfig, whoami, systeminfo*).
* **Credential Access:**
* OS Credential Dumping (**T1003.008** / **T1003**) – Extracting passwords from `/etc/passwd` and `/etc/shadow`.
* Browser Information Discovery (**T1217**) – Collecting passwords from Chrome storage.
* Bash History (**T1552.003**) and Credentials in Files (**T1552.001**).
* **Collection:**
* Audio/Video/Screen Capture (**T1123**, **T1125**, **T1113**).
* Email Collection (**T1114**).
* Archive via Custom Method/Utility (**T1560.003**, **T1560.001**).
## Targeting
* **Sectors:** Government, energy, and diplomatic entities (implied by geographical focus and TTPs).
* **Geography:** Central Asia and APAC (Asia-Pacific).
* **Victims:** Specific organizations were not named in the snippet, but the focus remains on regional entities in the aforementioned geographies.
## Tools & Infrastructure
* **Malware & Frameworks:**
* Custom Telegram-based malware.
* Cobalt Strike Beacon.
* Metasploit Framework.
* Webshells: Godzilla, Behinder.
* Utility Tools: Fscan, PEASS-ng.
* **Infrastructure:**
* **C2 Channels:** Use of Telegram for command and control and data exfiltration.
* **Proxies:** External Proxy (**T1090.002**) used to obfuscate traffic.
* **Defanged Examples:** (General pattern observed: `hxxps[://]api[.]telegram[.]org`, `hxxp[://]127[.]0[.]0[.]1` - *Note: Specific C2 IPs/domains were not listed in the provided text snippet, but the actor is known to use Telegram APIs.*)
## Implications
YoroTrooper represents a persistent threat to regional stability in Central Asia and APAC. Their ability to successfully compromise targets using a blend of commodity tools and custom scripts indicates a resourceful, if not always high-OPSEC, adversary. Their focus on credentials and screenshots suggests a primary goal of long-term intelligence gathering and espionage.
## Mitigations
* **Credential Protection:** Enforce Multi-Factor Authentication (MFA) across all external-facing services and internal administrative accounts to mitigate the impact of stolen credentials.
* **System Hardening:** Monitor and restrict the use of PowerShell, especially scripts attempting to connect to external endpoints or those using encoded commands.
* **Task Monitoring:** Audit and alert on the creation of new Scheduled Tasks and modifications to Registry Run keys.
* **Web Security:** Regularly scan web-facing servers for the presence of Godzilla or Behinder webshells and ensure server software is fully patched.
* **Network Visibility:** Monitor for unauthorized outbound traffic to known Telegram API endpoints, which may indicate the presence of the actor's custom malware.