Yellow Liderc

Yellow Liderc, also known as Imperial Kitten, Tortoiseshell, TA456, and Crimson Sandstorm, is a threat actor with malicious intent. This group has been active since 2022, engaging in cyber espionage against maritime, shipping, and logistics companies primarily in the Mediterranean region. Their methods involve compromising legitimate websites and inserting malicious JavaScript, using phishing emails, and deploying .NET malware. These tactics have evolved over time, making it challenging to defend against this threat actor by merely accounting for one method of injection or type of malware. In October, PwC highlighted Yellow Liderc's latest campaign, noting that the group had been using a combination of malicious JavaScript and .NET malware to conduct espionage attacks. The group's targets are diverse, and their tactics vary, making them a significant and unpredictable cybersecurity threat. They've been known to use highly targeted emails, fake social media accounts, and watering hole attacks in their global espionage campaigns. CrowdStrike has attributed these attacks to Imperial Kitten, another name for Yellow Liderc. The Islamic Revolutionary Guard Corps-backed threat actor has shown both continuity and evolution in its tactics and tools, according to a recent blog post from PricewaterhouseCoopers. It's essential to stay vigilant about this threat actor due to their persistent and evolving strategies, which have proven effective in their globe-spanning espionage campaigns.