Escalating Cyber Threats from Yellow Liderc
PwC’s recent analysis1 reveals an evolved cyber threat landscape where Yellow Liderc, an Iran-based threat actor, is heightening its cyber-espionage tactics.
Active since 2018, this actor targets a variety of sectors, from maritime to aerospace.
However, the newly discovered malware sample, IMAPLoader, indicates a significant shift in Yellow Liderc’s modus operandi, demonstrating more sophisticated techniques in their cyber arsenal.
IMAPLoader is a .NET malware that uses advanced techniques, unlike its predecessors. It employs ‘AppDomain Manager Injection,’ a unique injection method not previously associated with Yellow Liderc.
The malware serves as a downloader and uses email for Command and Control (C2) communication. Specifically, it interacts with hardcoded Yandex email accounts, which are encoded in decimals, to extract further malicious payloads.
Strategic Web Compromises Amplify Risks
The actor utilizes these compromised websites to infect systems that match specific fingerprints. This enables them to gain unauthorized access to the organization’s network, elevating the risk to Operational Technology (OT) systems.
Phishing Tactics Advance
Concurrent to strategic web compromises, Yellow Liderc has escalated its phishing operations. The phishing infrastructure links to compromised websites, extending beyond maritime sectors and targeting wider demographics, including the travel and hospitality sectors within Europe. In some instances, the phishing websites serve macro-enabled Excel documents that drop VBScripts, adding another layer to their complex cyber-espionage tactics.
TTPs Undergo Transformation
The actor’s evolving Tactics, Techniques, and Procedures (TTPs) are raising the stakes in cyber threat detection.
From using IMAP protocols for C2 communication to employing advanced malware injection techniques, Yellow Liderc shows an increased sophistication in its operations.
PwC recommends organizations to investigate historical logs and set up alerting systems based on the indicators provided in their report. Failure to do so may result in severe compromises, given the actor’s focus on a wide array of sectors and geographies.
The Bottom Line
The emergence of IMAPLoader signifies a pivotal moment in Yellow Liderc’s cyber espionage journey. The threat actor’s increased sophistication and multi-pronged attack methods point to a future where traditional cybersecurity measures may no longer suffice.
As Yellow Liderc continues to refine its strategies, organizations need to accelerate their cyber-defense mechanisms, lest they find themselves outmaneuvered in this escalating cyber warfare.
For organizations in targeted sectors, the clock is ticking. The time to bolster cybersecurity defenses is now.
- https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html ↩︎