Threadlinqs IntelligenceStart free

Threat actorKazakhstan (medium confidence)Tracked since 2026-10

YoroTrooper

Also known as:Silent Lynx

As of 2026-11-11, YoroTrooper is a Kazakhstan (medium confidence)-nexus threat actor tracked by Threadlinqs Intelligence across 2 threats spanning apt, vulnerability. Also known as Silent Lynx. ATT&CK coverage spans 28 techniques across 10 tactics in 2 of 2 tracked threats. Most-observed techniques: T1059.001 (PowerShell), T1190 (Exploit Public-Facing Application), T1204.002 (Malicious File).

Tracked threats
22 high
First seen
2026-10-15
Last seen
2026-11-11
ATT&CK techniques
28across 2 of 2 threats
Related CVEs
4Referenced by its activity
Attribution
Kazakhstan (medium confidence)Nation or origin
Nation: Kazakhstan (medium confidence) · 2 tracked threat(s) · Categories: APT, VULNERABILITY

Activity timeline

YoroTrooper appears in 2 tracked threats between and ; the busiest month was 2026-10 with 1 report.

ATT&CK techniques observed

28 techniques observed across 2 of 2 tracked threats · Persistence (5), Command and Control (4), Credential Access (4), Execution (4), Initial Access (3), Stealth (formerly Defense Evasion) (3)
  • T1059.001 PowerShell — Executionobserved in 2 of 2 tracked threats
  • T1190 Exploit Public-Facing Application — Initial Accessobserved in 2 of 2 tracked threats
  • T1204.002 Malicious File — Executionobserved in 2 of 2 tracked threats
  • T1566.001 Spearphishing Attachment — Initial Accessobserved in 2 of 2 tracked threats
  • T1003.003 OS Credential Dumping: NTDS — Credential Accessobserved in 1 of 2 tracked threats
  • T1027 Obfuscated Files or Information — Stealth (formerly Defense Evasion)observed in 1 of 2 tracked threats
  • T1036.004 Masquerading: Masquerade Task or Service — Stealth (formerly Defense Evasion)observed in 1 of 2 tracked threats
  • T1039 Data from Network Shared Drive — Collectionobserved in 1 of 2 tracked threats
  • T1046 Network Service Discovery — Discoveryobserved in 1 of 2 tracked threats
  • T1053.003 Cron — Persistenceobserved in 1 of 2 tracked threats
  • T1053.005 Scheduled Task/Job: Scheduled Task — Persistenceobserved in 1 of 2 tracked threats
  • T1059.005 Visual Basic — Executionobserved in 1 of 2 tracked threats
  • T1070.003 Clear Command History — Stealth (formerly Defense Evasion)observed in 1 of 2 tracked threats
  • T1078 Valid Accounts — Initial Accessobserved in 1 of 2 tracked threats
  • T1087.002 Account Discovery: Domain Account — Discoveryobserved in 1 of 2 tracked threats

Tracked threats

Related CVEs

4 CVEs referenced by tracked YoroTrooper activity