Threat video1:00
YoroTrooper Silent Lynx Laplas Implants: Detection & IOCs
YoroTrooper's exposed server shows Laplas/Chvost implants and AI-agent intrusions in Tajikistan. 9 detection rules, 23 IOCs and a free Splunk SPL rule.
Read the full threat intel for YoroTrooper Silent Lynx Laplas Implants: Detection & IOCs →
Chapters
- 0:00The hookAn AI agent ran espionage intrusions.
- 0:04The storyIn August, intruders entered Tajikistan's railway.
- 0:11Attack pathCloudSEK found an AI agent running operations.
- 0:27AttributionAttributed to YoroTrooper.
- 0:32Indicators of compromise18 indicators to hunt: 2 IPs, 1 domain and 2 URLs, and more.
- 0:38MITRE ATT&CK techniques19 ATT&CK techniques, from initial access to command and control.
- 0:43Remediation14 remediation steps are listed, 5 of them immediate.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00An AI agent ran espionage intrusions.
0:05In August, intruders entered Tajikistan's railway.
0:08Root SSH logins ran 5 days.
0:12CloudSEK found an AI agent running operations.
0:15Spearphishing LNK files delivered the implant.
0:19Lookalike service names provided persistence.
0:22Then cleanup deleted messages and login records.
0:28Attributed to YoroTrooper. Confidence: medium.
0:3218 indicators to hunt: 2 IPs, 1 domain and 2 URLs, and more.
0:3819 ATT&CK techniques, from initial access to command and control.
0:4414 remediation steps are listed, 5 of them immediate.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.