Actor Profile

Yoba is a cybercrime campaign (not a named threat actor group) focused on distributing cryptocurrency miners through fraudulent GitHub repositories. The operation leverages the popularity of AI tools by creating fake desktop applications for ChatGPT and Claude. The campaign operators use multiple email addresses with inconsistent UTC time zones (UTC+4, UTC-4, UTC+3), likely to obscure their true operational location. Geographic exclusions in the malware (Russia, Belarus, Tajikistan, Armenia, Azerbaijan, Georgia, Kazakhstan, Kyrgyzstan, Turkmenistan, Uzbekistan, and Tatar language) suggest operators may be based in or protecting users from these regions. Notably, Ukraine is not excluded, diverging from historical patterns. The campaign demonstrates sophisticated OPSEC including SEO poisoning, DLL sideloading, and multi-stage infection chains.

TTPs (Tactics, Techniques, Procedures)

The campaign employs T1574.002 (DLL Side-Loading) as its primary execution technique, placing malicious DLLs alongside legitimate signed executables from OpenAI and Anthropic. Initial access occurs via T1189 (Drive-by Compromise) through SEO-poisoned search results leading to fake GitHub repositories. T1027 (Obfuscated Files or Information) is used extensively with encrypted payloads and checksum validation. T1497 (Virtualization/Sandbox Evasion) includes 200,000 sleep iterations (12.73 days), keyboard layout checks, and executable basename hash validation. Persistence is established via T1053.005 (Scheduled Task/Job). The malware uses T1568.002 (Domain Generation Algorithms) to construct C2 domains from Telegram-seeded data, and T1071.001 (Application Layer Protocol: Web Protocols) via Google DNS-over-HTTPS to retrieve Base64-encoded commands from DNS TXT records. Final payload is T1055 (Process Injection) into svchost.exe, deploying T1496 (Resource Hijacking) through XMRig cryptocurrency miner.

Targets & Patterns

The campaign targets software developers and cryptocurrency enthusiasts who actively search for AI desktop applications, particularly ChatGPT and Claude tools. Victims are users seeking cutting-edge AI capabilities (GPT-5.6 Sol, GPT-6 Astra, Claude Opus) who trust GitHub as a legitimate software distribution platform. The targeting strategy exploits the current AI hype cycle and developer workflows that frequently involve downloading tools from GitHub. Geographic targeting is global except for CIS countries (Russia, Belarus, and Central Asian republics) plus Tatar speakers, suggesting the operators either originate from or wish to avoid attention in these regions. The use of SEO poisoning ensures victims discover malicious repositories through organic Google searches, making the attack vector highly scalable and requiring minimal direct victim interaction.

Historical Context

The Yoba campaign infrastructure began in July 2026 with the first GitHub repository creation, though malicious releases were not uploaded until late August 2026. Early versions of YobaLoader exhibited different characteristics: initially only Russia was excluded from infection, and extensive anti-debugging and anti-VM checks were present. These checks have been removed in newer versions, suggesting operational refinement based on detection challenges or performance issues. The evolution from single-country exclusion to broader CIS exclusions may indicate shifting operational security concerns or expanded threat actor collaboration. The notable absence of Ukraine from geographic exclusions represents a departure from historical malware campaigns originating from CIS regions, which traditionally excluded Ukraine alongside Russia and other former Soviet states.

Defensive Recommendations

  • Monitor for DLL sideloading activity (T1574.002) by detecting legitimate signed executables (Setup.exe, wmpdmc.exe) loading unexpected DLLs (winmm.dll, ampdui.dll, wmpdui.dll) from non-standard directories like ProgramData\WMProcess
  • Implement DNS monitoring for DGA-generated domains matching the pattern 'adjective-noun-verb-digit.dedyn[.]io' and flag DNS-over-HTTPS queries to Google's DoH API (dns.google) from non-browser processes
  • Detect cryptocurrency mining activity (T1496) by monitoring for XMRig indicators, unusual CPU usage from svchost.exe, and network connections to known mining pools
  • Block or alert on scheduled tasks (T1053.005) that launch Windows Media Player components (wmpdmc.exe) from ProgramData directories rather than System32
  • Flag GitHub repositories and downloads claiming to offer unreleased AI model versions (GPT-5, GPT-6, Claude Opus 5.0) and implement user awareness training about downloading AI tools from unofficial sources
  • Monitor for extreme sleep/delay loops (T1497) exceeding several hours as anti-sandbox evasion, and detect processes checking keyboard layouts or language IDs associated with CIS countries