Cyber Espionage Techniques.

The goal of the campaign is espionage, with the hackers creating malicious domains or spoofing commonly-visited ones from CIS entities that host malware. Victims are also compromised through malicious shortcut files and decoy PDF documents sent to targets in phishing emails.

It appears that you are describing a campaign of cyber espionage that involves various techniques to compromise targets. The hackers seem to be using malicious domains or spoofed ones from CIS entities to host malware, as well as phishing emails with malicious shortcut files and decoy PDF documents to deceive and compromise their victims. Espionage is the act of gathering sensitive information without authorization, and cyber espionage involves using technology to steal such information. In this case, the hackers seem to be using a combination of social engineering and technical exploits to gain access to their targets' systems and steal sensitive information. Creating malicious domains or spoofing commonly-visited ones can trick victims into visiting websites that appear legitimate but are actually designed to install malware on their devices. Similarly, phishing emails with malicious attachments or links can fool targets into downloading malware or revealing sensitive information. It is important for individuals and organizations to be vigilant against these types of attacks by regularly updating their security software, using strong passwords, and being cautious of suspicious emails and websites. In addition, it is recommended to use two-factor authentication and to regularly back up important data to prevent loss of critical information in the event of a successful attack.

The group has already been able to steal credentials, browser histories, system information and screenshots in attacks seen by Cisco researchers. They primarily use custom-built information stealers and remote access malware. Cisco found at least three separate clusters of activity connected to the campaign since it began operating in June 2022, with several malicious domains created that spoof legitimate European Union government agencies. The hackers stole information during successful attacks on embassies belonging to Turkmenistan and Azerbaijan. The attacks gave the hackers access to credentials that Cisco said would be useful for lateral movement during subsequent attacks and browsing histories that are key for understanding what domains to spoof in future attacks. Cisco was able to tie the campaign to PoetRAT – another hacking team the company discovered in 2020 after several attacks on Azerbaijan embassies and other government agencies. The researchers could not find concrete ties between the operators of PoetRAT and YoroTrooper but said the tactics, tools and victims indicated similarities. Both used specialized Python-based tools and targeted Azerbaijan – specifically their embassies – the energy sector and government institutions.

It seems that the hackers behind this campaign are highly skilled and well-equipped, using custom-built information stealers and remote access malware to steal sensitive information such as credentials, browser histories, system information, and screenshots. The attacks have targeted several European Union government agencies, and Cisco researchers have identified at least three separate clusters of activity associated with the campaign since it began in June 2022. The hackers have successfully breached the embassies of Turkmenistan and Azerbaijan, giving them access to valuable credentials and browsing histories that could be used in future attacks. Cisco has linked the campaign to PoetRAT, another hacking group that the company discovered in 2020 after several attacks on Azerbaijan embassies and other government agencies. While the researchers could not find concrete ties between the operators of PoetRAT and YoroTrooper, they noted similarities in tactics, tools, and targets, including the use of specialized Python-based tools and a focus on Azerbaijan's embassies, energy sector, and government institutions. It is clear that this campaign poses a serious threat to organizations and individuals, and it is important for everyone to take steps to protect their sensitive information and networks. This includes implementing strong security measures such as firewalls, anti-virus software, and multi-factor authentication, as well as educating employees about the risks of phishing attacks and other social engineering tactics. It is also essential to keep software and systems up to date with the latest security patches to minimize vulnerabilities that could be exploited by hackers.