Kazakhstan-associated Yoro Trooper disguises origin of attacks as Azerbaijan
Summary: Cisco Talos assesses with high confidence that the YoroTrooper operators are likely based in Kazakhstan, citing their use of Kazakh, Russian and Uzbek languages, their tracking of Kazakhstani Tenge-to-Bitcoin conversion rates, and their targeting of only one Kazakhstani entity, the government's Anti-Corruption Agency. Talos says the group routes most operations through Azerbaijan and translates Azerbaijani material into Russian to disguise its origin, while compromising state-owned websites in Tajikistan and Kyrgyzstan and a senior official at the Uzbek Ministry of Energy between May and September 2023.
What you should know: The group exfiltrated 165MB of documents from a Tajik government-associated victim and compromised three state-owned websites in Tajikistan and Kyrgyzstan, with some malware still hosted as of September 2023 - and Talos has not ruled out that the operators work under the direction of the Kazakh government.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026