Yellow Garuda

Yellow Garuda, also known as Charming Kitten, APT35, Mint Sandstorm, Cobalt Illusion, and TA453 among other names, is a threat actor believed to be operating on behalf of Iran's Islamic Revolutionary Guard Corps (IRGC). The group has been active in various cyber espionage campaigns over the years. In July 2022, PWC reported that Yellow Garuda was distributing malicious DOCX files hosted on Dropbox and AWS. The cybersecurity industry has observed this threat actor using various tactics and techniques, including spear-phishing attacks and the use of backdoors like POWERSTAR and BASICSTAR. The group escalated its activities in 2023, launching a new wave of spear-phishing attacks deploying the POWERSTAR backdoor since May. These attacks were part of a broader campaign by the Iranian state-sponsored operation targeting nuclear security experts. Proofpoint, a cybersecurity firm, detailed these actions, highlighting the threat actor's focus on high-profile targets. The group also executed a phishing attack against an Israeli rabbi, demonstrating its wide range of targets. In 2024, Yellow Garuda further diversified its attack methods, deploying a novel backdoor called BASICSTAR. This new tool was used against Middle East policy experts between September and October of the previous year. The group impersonated the Rasanah International Institute for Iranian Studies, tricking victims into joining a fake webinar that facilitated the download of the BASICSTAR malware. This allowed the threat actor to exfiltrate system data and execute commands remotely, according to a report by Volexity. Given the continuous evolution and persistence of Yellow Garuda's tactics, the threat actor remains a significant concern in the realm of cybersecurity.