Hydra Saiga
Hydra Saiga (aka Yorotrooper, ShadowSilk, Silent Lynx) is a suspected Kazakhstan-aligned, likely state-sponsored espionage threat actor assessed active since at least 2021 and still operating into late 2025. Reporting attributes to the group campaigns targeting government, energy, and critical infrastructure organizations across Central Asia, Europe, and the Middle East, with claims of at least 34 organizations compromised across 8 countries and reconnaissance/login attempts against 200+ additional targets. A defining tradecraft element is heavy use of the Telegram Bot API for C2 (including /getUpdates), alongside a mix of commodity tooling (e.g., Havoc, resocks, Meterpreter) and custom implants/backdoors written in PowerShell, Python, Go, and Rust. Initial access described includes phishing lures such as a loader masquerading as a Turkmenistan-to-UN letter (executing a Base64-encoded PowerShell backdoor and attempting to bypass PowerShell execution policy/profiles) and a macro-enabled Word document delivered to the Royal Oman Police (download/execution of an obfuscated PowerShell backdoor from 185.106.92[.]127; that host also served a Meterpreter payload around the same time). Delivery mechanisms include ISO/RAR attachments sent from previously compromised email accounts. Post-compromise activity is characterized as hands-on-keyboard “living off the land,” with persistence via scheduled tasks and registry manipulation; credential access via LSASS dumping, SAM/SECURITY hive export, enabling WDigest, and use of FakeLogonScreen; lateral movement via nltest for DC discovery and WMI/PsExec to deploy a reverse SOCKS5 proxy; defense evasion via disabling Microsoft Defender features and the Windows firewall; collection via screenshots and RAR archiving; tool transfer via curl/wget/bitsadmin/PowerShell (often password-protected RARs); and exfiltration via curl POSTs plus browser-data stealers (PyInstaller-based, later Golang). The actor reportedly uses Censys/Shodan for recon and Acunetix for vulnerability scanning, and has used infrastructure from providers such as BitLaunch and PSB Hosting, with domains registered via QHoster. Attribution support cited includes an operator work pattern consistent with UTC+5 and inactivity on Kazakhstani holidays, plus infrastructure/tooling overlap with the Tomiris cluster (including references to JLORAT/Telemiris lineage and shared Telegram-based C2 patterns).
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Energy
- Capital Goods
- Commercial & Professional Services
- Transportation
- Health Care Equipment & Services
- Software & Services
Where they target
Geographies tied to known operations.
- 🇦🇫 Afghanistan
- 🇦🇲 Armenia
- 🇦🇷 Argentina
- 🇦🇿 Azerbaijan
- 🇧🇩 Bangladesh
- 🇧🇬 Bulgaria
- 🇧🇷 Brazil
- 🇧🇾 Belarus
Where they're from
Attributed origin per open-source reporting.
- KZ
Tradecraft
27 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
6 malware families attributed to this actor across reporting.
1 additional family tracked in Mallory.
Observables
71 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Espionage/infiltration actor (reported as Kazakhstani) targeting sectors including energy and legal; uses custom implants (Rust/Go/Python) and living-off-the-land techniques; adapts to bypass modern defenses such as Chrome app-bound encryption.
State-aligned espionage/infiltration activity focused on government and critical utilities (notably water and energy) across Central Asia and beyond. Uses Telegram Bot API as a defining C2 channel, combines custom implants (Rust/Go/Python/PowerShell) with heavy hands-on-keyboard living-off-the-land post-exploitation, credential theft, lateral movement, and data exfiltration (including browser credential/cookie theft).
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.