Talos uncovers espionage campaigns targeting CIS countries, embassies and EU health care agency
Summary: Cisco Talos has named a threat actor "YoroTrooper" that has targeted governments across Eastern Europe since at least June 2022, running three activity clusters on overlapping infrastructure. Talos says the operators are Russian-language speakers motivated by espionage, and that they obtained credentials from at least one account at a critical EU health care agency's internet-exposed system and another at the World Intellectual Property Organization, while also compromising embassies belonging to Turkmenistan and Azerbaijan.
What you should know: The actor reached an internet-exposed system at a critical EU health care agency and an account at WIPO using a simple chain of phishing archives, shortcut files and commodity or Python-based malware, and Talos cannot say whether those institutions were singled out or caught because their users appeared on a list of targeted European countries.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026