APT Explorer

All actors

YoroTrooper

Also reported as Silent Lynx, Salted Earth, Sturgeon Fisher, ShadowSilk, Cavalry Werewolf and 2 other names. Linked to Kazakhstan by three sources.

Reports
15
Last reported
Known CVEs
29
Origin
Kazakhstan
ID
yorotrooper
Sources
MISPETDAMalpedia
Merge evidence
10 alias matches

Reports per quarter

Dated reports, 2023 Q1 to 2026 Q2.

Techniques seen in the last two years

Show all 46 techniques Show fewer

Counts come from technique IDs in the actor's report text.

CVEs named in reports

Show all 29 CVEs Show fewer

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

  1. Ave Maria (Malware Family)

    date ORKL added it ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

  2. APT and financial attacks on industrial organizations in H1 2023 | Kaspersky ICS CERT EN

    date ORKL added it ORKL

    Archived copy on ORKL Details

  3. CTO at NCSC Summary: week ending October 29th

    date ORKL added it ORKL

    Archived copy on ORKL Details

  4. APT and financial attacks on industrial organizations in Q3 2025 | Kaspersky ICS CERT EN

    Malpedia library date ORKL

    Archived copy on ORKL Details

  5. INTRINSEC-2025-Threat-Report-Trouble_in_the_air.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  6. Operation Peek-a-Baku: Silent Lynx APT makes sluggish shift to Dushanbe

    Malpedia library date ORKL

    Archived copy on ORKL Details

  7. Cavalry Werewolf raids Russia’s public sector with trusted relationship attacks

    Malpedia library date ORKL

    Archived copy on ORKL Details

  8. ShadowSilk: A Cross-Border Binary Union for Data Exfiltration | Group-IB Blog

    Malpedia library date ORKL

    Archived copy on ORKL Details

  9. Unveiling Silent Lynx APT Targeting Entities Across Kyrgyzstan & Neighbouring Nations

    Malpedia library date ORKL

    Archived copy on ORKL Details

  10. ESET APT Activity Report Q2 2023-Q3 2023: Government espionage and unpatched vulnerabilities

    file creation date ORKL

    Archived copy on ORKL Details

Show all 15 reports Show fewer

  1. ESET APT Activity Report Q2 2023-Q3 2023: Government espionage and unpatched vulnerabilities

    Malpedia library date ESET ORKLCCS '25 data

    Archived copy on ORKL Details

  2. Kazakhstan-associated YoroTrooper disguises origin of attacks as Azerbaijan

    Malpedia library date ORKL

    Archived copy on ORKL Details

  3. Talos uncovers espionage campaigns targeting CIS countries, embassies and EU health care agency

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  4. Talos uncovers espionage campaigns targeting CIS countries, embassies and EU health care agency

    Malpedia library date ORKL

    Archived copy on ORKL Details

  5. eset_apt_activity_report_t32022.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

Newest first. Details opens the report in Explore.