A cyberspy outfit is attacking high-level targets in the EU


Share post:

Threat actor YoroTrooper has compromised the accounts of critical EU healthcare agencies, a number of embassies, and the World Intellectual Property Organization (WIPO).

A report from Cisco Talos (via BleepingComputer) has revealed that vast quantities of data, such as credentials, cookies, and browser histories, have been stolen from a number of infected endpoints.

These include those belonging to government agencies and energy companies of countries that are a part of Eurasia’s Commonwealth of Independent States (CIS).

YoroTrooper’s unique threat activity

Though BleepingComputer notes that YoroTrooper has previously been known to disseminate known malware like PoetRAT and LodaRAT, Cisco thinks it’s moved to designing its own Remote Access Trojans (RATs) written in Python to get the job done.

In Summer 2022, Belarusian organizations were hit by infected PDF files sent from email domains purporting to be organizations from Belarus or Russia. In September that year, YoroTrooper registered typosquatting domains to appear as similar as Russian government agencies as possible.

This strategy is rooted in YoroTrooper’s phishing emails needing to look as legitimate as possible, particularly as its latest ruse involves attaching infected RAR and ZIP attachments to gain access to national security information across the region.

In 2023, the threat group has moved fast. In January, it began issuing an infostealer script that extracts credentials from Chromium-based browsers, but in February, had already moved to a new modular tool called ‘Stink’.

The new tool, in addition to Chromium browser infiltration and basic system information, also steals data from FTP client Filezilla and messaging apps Discord and Telegram.

YoroTrooper’s motives, means, and backers are currently unknown, but the move to custom tools could turn out to be a worrying development for the corporate world.

Source link


Related articles

Marvel’s Spider-Man 2: Venom Voice Actor Hints At September Release Date

Editor’s Note: This story’s headline has been changed to better reflect that a voice actor from Marvel’s Spider-Man...

Newegg is making it easier to buy your ideal NAS

Online computer hardware retailer Newegg has just released a new web tool designed to make buying your...

'Greenwashing' Targeted in Latest European Regulatory Push

European officials rolled out proposals aimed at forcing companies to back up environmental and sustainability claims they...

The Black Inventors Behind 7 Everyday Kitchen Tools

A tall glass of freshly squeezed lemonade. Warm, fluffy, buttery biscuits. A perfectly scooped ball of ice...