Silent Lynx (YoroTrooper) Exposed: Laplas, Chvost & PickleShell Espionage Toolkit — OTX Pulse Analysis & Detection Pack

---
title: Silent Lynx PickleShell Python Deserialization Execution
id: 8f2c1a3e-7b4d-4e9a-a1c5-2d6f8b3e9a01
status: experimental
description: Detects suspicious Python interpreter execution consistent with PickleShell backdoor usage — python/pythonw spawned with Base64-encoded or pickle-related arguments, commonly deployed by Silent Lynx/YoroTrooper as an interactive espionage channel.
references:
    - https://otx.alienvault.com/pulse/
    - https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server
author: Security Arsenal Threat Intelligence
date: 2026/11/12
tags:
    - attack.execution
    - attack.t1059.006
logsource:
    category: process_creation
    product: windows
Detection:
    selection_image:
        Image|endswith:
            - '\python.exe'
            - '\pythonw.exe'
    selection_cmd:
        CommandLine|contains:
            - 'pickle.loads'
            - 'cPickle'
            - '__reduce__'
            - 'base64.b64decode'
            - 'import pickle'
            - ' -c '
    condition: selection_image and selection_cmd
falsepositives:
    - Legitimate Python development or automation scripts
degree: high
---
title: Silent Lynx Laplas Chvost Persistence via Scheduled Task or Run Key
id: 1a7d3f92-4c5e-4b8a-9d2e-6f1a3c8e5b02
status: experimental
description: Detects persistence mechanisms used by Chvost and Laplas implants — scheduled task creation or registry Run key modification pointing to payloads in user-writable directories (AppData, Temp, ProgramData), as observed in Silent Lynx operations against Central Asian targets.
references:
    - https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server
author: Security Arsenal Threat Intelligence
date: 2026/11/12
tags:
    - attack.persistence
    - attack.t1053.005
    - attack.t1547.001
logsource:
    category: process_creation
    product: windows
Detection:
    selection_schtasks:
        Image|endswith: '\schtasks.exe'
        CommandLine|contains: '/create'
    selection_reg:
        Image|endswith:
            - '\reg.exe'
            - '\regedit.exe'
        CommandLine|contains:
            - 'CurrentVersion\Run'
    selection_paths:
        CommandLine|contains:
            - '\AppData\Roaming\'
            - '\AppData\Local\Temp\'
            - '\ProgramData\'
            - '%APPDATA%'
            - '%TEMP%'
    condition: (selection_schtasks or selection_reg) and selection_paths
falsepositives:
    - Software installers and enterprise deployment tools
degree: medium
---
title: Silent Lynx C2 Communication to Known Infrastructure
id: 5c9e2b41-8a3f-4d7c-b6e1-9f4a2d7c3e03
status: experimental
description: Detects network connections to known Silent Lynx/YoroTrooper C2 infrastructure identified in OTX pulse — IPv4 addresses 89.125.213.123 and 134.17.14.24 and domain foreverpeace.ru used for Laplas/Chvost beaconing and exfiltration.
references:
    - https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server
author: Security Arsenal Threat Intelligence
date: 2026/11/12
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
    product: windows
Detection:
    selection_ip:
        DestinationIp:
            - '89.125.213.123'
            - '134.17.14.24'
    selection_domain:
        DestinationHostname|contains: 'foreverpeace.ru'
    condition: selection_ip or selection_domain
falsepositives:
    - None expected; these are confirmed adversary infrastructure
degree: critical

// Silent Lynx / YoroTrooper Hunt — C2, Persistence, and Python Backdoor Behavior
// Microsoft Sentinel / Defender XDR — run over last 30 days minimum
let maliciousIPs = dynamic(["89.125.213.123", "134.17.14.24"]);
let maliciousDomain = "foreverpeace.ru";
let iocHits = DeviceNetworkEvents
    | where TimeGenerated > ago(30d)
    | where RemoteIP in (maliciousIPs)
       or RemoteUrl has maliciousDomain
    | project IoCMatch="Network-C2", TimeGenerated, DeviceName, RemoteIP, RemoteUrl,
              RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName;
let pythonBackdoor = DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | where FileName in~ ("python.exe", "pythonw.exe", "py.exe")
    | where ProcessCommandLine has_any ("pickle", "b64decode", "__reduce__", "-c ")
       or (ProcessCommandLine matches regex @"[A-Za-z0-9+/]{100,}={0,2}")
    | project IoCMatch="PickleShell-Behavior", TimeGenerated, DeviceName,
              InitiatingProcessFileName, ProcessCommandLine, AccountName, FileName;
let persistenceArtifacts = DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | where (FileName =~ "schtasks.exe" and ProcessCommandLine has "/create")
         or (FileName in~ ("reg.exe", "regedit.exe") and ProcessCommandLine has "CurrentVersion\\Run")
    | where ProcessCommandLine has_any ("AppData", "ProgramData", "%TEMP%", "%APPDATA%")
    | project IoCMatch="Persistence-Behavior", TimeGenerated, DeviceName,
              InitiatingProcessFileName, ProcessCommandLine, AccountName, FileName;
union iocHits, pythonBackdoor, persistenceArtifacts
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated),
            HitCount=count(), Artifacts=make_set(IoCMatch)
            by DeviceName, AccountName
| order by HitCount desc;

# Silent Lynx / YoroTrooper IOC Hunt Script
# Checks: network connections, Run keys, scheduled tasks, and file hash presence
# Run as Administrator on suspected endpoints. Output: console + CSV artifact.

$ErrorActionPreference = 'SilentlyContinue'
$report = @()

Write-Host "[+] Silent Lynx / YoroTrooper Hunt — $(Get-Date)" -ForegroundColor Cyan

# --- 1. Active & historical network connections to C2 infrastructure ---
$c2IPs = @('89.125.213.123', '134.17.14.24')
Write-Host "[*] Checking network connections to known C2 IPs..." -ForegroundColor Yellow
$conns = Get-NetTCPConnection | Where-Object { $c2IPs -contains $_.RemoteAddress }
foreach ($c in $conns) {
    $proc = Get-Process -Id $c.OwningProcess
    $report += [PSCustomObject]@{
        Check = 'Network-C2'; Status = 'HIT'; Host = $env:COMPUTERNAME
        Detail = "$($proc.ProcessName) (PID $($c.OwningProcess)) -> $($c.RemoteAddress):$($c.RemotePort) [$($c.State)]"
    }
}

# --- 2. DNS cache check for foreverpeace.ru ---
Write-Host "[*] Checking DNS cache for foreverpeace.ru..." -ForegroundColor Yellow
$dns = Get-DnsClientCache | Where-Object { $_.Entry -like '*foreverpeace.ru*' }
foreach ($d in $dns) {
    $report += [PSCustomObject]@{
        Check = 'DNS-Cache'; Status = 'HIT'; Host = $env:COMPUTERNAME
        Detail = "$($d.Entry) -> $($d.Data)"
    }
}

# --- 3. Registry Run keys pointing to user-writable paths (Chvost persistence) ---
Write-Host "[*] Auditing Run keys for suspicious persistence..." -ForegroundColor Yellow
$runKeys = @(
    'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
    'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run'
)
foreach ($key in $runKeys) {
    Get-ItemProperty -Path $key | ForEach-Object {
        $_.PSObject.Properties | Where-Object {
            $_.Name -notmatch '^PS' -and
            $_.Value -match 'AppData|Temp|ProgramData|python'
        } | ForEach-Object {
            $report += [PSCustomObject]@{
                Check = 'RunKey'; Status = 'REVIEW'; Host = $env:COMPUTERNAME
                Detail = "$key :: $($_.Name) = $($_.Value)"
            }
        }
    }
}

# --- 4. Scheduled tasks executing from user-writable paths ---
Write-Host "[*] Auditing scheduled tasks for Chvost-style persistence..." -ForegroundColor Yellow
Get-ScheduledTask | ForEach-Object {
    $task = $_
    $task.Actions | Where-Object {
        $_.Execute -match 'AppData|Temp|ProgramData|python' -or $_.Arguments -match 'AppData|Temp|b64'
    } | ForEach-Object {
        $report += [PSCustomObject]@{
            Check = 'SchedTask'; Status = 'REVIEW'; Host = $env:COMPUTERNAME
            Detail = "$($task.TaskName) :: $($_.Execute) $($_.Arguments)"
        }
    }
}

# --- 5. File hash sweep in high-risk directories ---
$targetHash = 'efc1bbb873e9b691657a66e987b0ea87c454bb16e89126d1a41bcaa9bae9fab1'
Write-Host "[*] Sweeping for known Laplas/Chvost sample hash..." -ForegroundColor Yellow
$searchPaths = @("$env:APPDATA", "$env:LOCALAPPDATA\Temp", "$env:ProgramData", "$env:USERPROFILE\Downloads")
foreach ($path in $searchPaths) {
    Get-ChildItem -Path $path -Recurse -File -Include *.exe,*.dll,*.py,*.ps1,*.lnk -ErrorAction SilentlyContinue | ForEach-Object {
        $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256).Hash
        if ($hash -eq $targetHash) {
            $report += [PSCustomObject]@{
                Check = 'FileHash'; Status = 'HIT'; Host = $env:COMPUTERNAME
                Detail = "MALWARE SAMPLE FOUND: $($_.FullName)"
            }
        }
    }
}

# --- Output ---
if ($report.Count -gt 0) {
    $report | Format-Table -AutoSize | Out-String -Width 300 | Write-Host -ForegroundColor Red
    $report | Export-Csv -Path ".\silentlynx_hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
    Write-Host "[!] $($report.Count) findings exported to CSV. Escalate HIT items to IR immediately." -ForegroundColor Red
} else {
    Write-Host "[OK] No Silent Lynx indicators found on $env:COMPUTERNAME." -ForegroundColor Green
}