# YoroTrooper

> As of 2026-11-11, YoroTrooper is a Kazakhstan (medium confidence)-nexus threat actor tracked by Threadlinqs Intelligence across 2 threats spanning apt, vulnerability. Also known as Silent Lynx. ATT&CK coverage spans 28 techniques across 10 tactics in 2 of 2 tracked threats. Most-observed techniques: T1059.001 (PowerShell), T1190 (Exploit Public-Facing Application), T1204.002 (Malicious File).

- **Nation:** Kazakhstan (medium confidence)
- **Tracked threats:** 2
- **Categories:** APT, VULNERABILITY
- **Also known as:** Silent Lynx
- **As of:** 2026-11-11

## ATT&CK techniques observed

28 techniques observed across 2 of 2 tracked threats. Tactics: Persistence (5), Command and Control (4), Credential Access (4), Execution (4), Initial Access (3), Stealth (formerly Defense Evasion) (3).

- [T1059.001](https://intel.threadlinqs.com/technique/T1059.001) PowerShell — Execution — observed in 2 of 2 tracked threats
- [T1190](https://intel.threadlinqs.com/technique/T1190) Exploit Public-Facing Application — Initial Access — observed in 2 of 2 tracked threats
- [T1204.002](https://intel.threadlinqs.com/technique/T1204.002) Malicious File — Execution — observed in 2 of 2 tracked threats
- [T1566.001](https://intel.threadlinqs.com/technique/T1566.001) Spearphishing Attachment — Initial Access — observed in 2 of 2 tracked threats
- [T1003.003](https://intel.threadlinqs.com/technique/T1003.003) OS Credential Dumping: NTDS — Credential Access — observed in 1 of 2 tracked threats
- [T1027](https://intel.threadlinqs.com/technique/T1027) Obfuscated Files or Information — Stealth (formerly Defense Evasion) — observed in 1 of 2 tracked threats
- [T1036.004](https://intel.threadlinqs.com/technique/T1036.004) Masquerading: Masquerade Task or Service — Stealth (formerly Defense Evasion) — observed in 1 of 2 tracked threats
- [T1039](https://intel.threadlinqs.com/technique/T1039) Data from Network Shared Drive — Collection — observed in 1 of 2 tracked threats
- [T1046](https://intel.threadlinqs.com/technique/T1046) Network Service Discovery — Discovery — observed in 1 of 2 tracked threats
- [T1053.003](https://intel.threadlinqs.com/technique/T1053.003) Cron — Persistence — observed in 1 of 2 tracked threats
- [T1053.005](https://intel.threadlinqs.com/technique/T1053.005) Scheduled Task/Job: Scheduled Task — Persistence — observed in 1 of 2 tracked threats
- [T1059.005](https://intel.threadlinqs.com/technique/T1059.005) Visual Basic — Execution — observed in 1 of 2 tracked threats
- [T1070.003](https://intel.threadlinqs.com/technique/T1070.003) Clear Command History — Stealth (formerly Defense Evasion) — observed in 1 of 2 tracked threats
- [T1078](https://intel.threadlinqs.com/technique/T1078) Valid Accounts — Initial Access — observed in 1 of 2 tracked threats
- [T1087.002](https://intel.threadlinqs.com/technique/T1087.002) Account Discovery: Domain Account — Discovery — observed in 1 of 2 tracked threats

## Tracked threats

- [Silent Lynx (UAT-6275 / TAG-193) exposed server: Laplas/Chvost implants and AI-agent-driven intrusions against Tajikistan railway and EDO, Uzbekistan Smart Forestry, and Turkmenistan-themed lures](https://intel.threadlinqs.com/threat/TL-2026-5756) — HIGH
- [Talos Q3 2026 Vulnerability Pulse: Ivanti Connect Secure Zero-Day CVE-2026-104935, SonicWall SMA1000 SSRF CVE-2026-102255, and UAT-6275 (Silent Lynx) Espionage](https://intel.threadlinqs.com/threat/TL-2026-3651) — HIGH

## Related CVEs

4 CVEs referenced by tracked YoroTrooper activity.

- [CVE-2026-104935](https://intel.threadlinqs.com/cve/CVE-2026-104935)
- [CVE-2026-102255](https://intel.threadlinqs.com/cve/CVE-2026-102255)
- [CVE-2025-8088](https://intel.threadlinqs.com/cve/CVE-2025-8088)
- [CVE-2025-25257](https://intel.threadlinqs.com/cve/CVE-2025-25257)

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) unlock per threat with TL Creds (https://threadlinqs.com/tl-creds); the Threadlinqs MCP server (Purple) serves them to AI agents: https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/YoroTrooper