Kazakhstan-associated YoroTrooper disguises origin of attacks as Azerbaijan

• Cisco Talos assesses with high confidence that YoroTrooper, an espionage-focused threat actor first active in June 2022, likely consists of individuals from Kazakhstan based on their use of Kazakh currency and fluency in Kazakh and Russian. The actor also appears to have a defensive interest in the website of the Kazakhstani state-owned email service and has rarely targeted Kazakh entities.


• YoroTrooper attempts to obfuscate the origin of their operations, employing various tactics to make its malicious activity appear to emanate …

actor attacks azerbaijan cisco cisco talos currency defensive espionage high interest june kazakhstan origin russian state talos threat threat actor website yorotrooper