Yellow Garuda

Yellow Garuda is PwC's designation for the Iranian threat cluster aligned with Charming Kitten and APT42 activity. PwC uses this name to track IRGC-linked espionage operations targeting NGOs, media organizations, and policy researchers, particularly in Western countries and Israel. Yellow Garuda operations share credential harvesting infrastructure, targeting profiles, and social engineering techniques with the APT42 and Charming Kitten clusters as documented by Mandiant and Microsoft. The designation reflects PwC's independent tracking of the same underlying Iranian state actor under a distinct naming convention.