Yellow Liderc

Yellow Liderc is PwC's designation for the Iranian threat cluster known as Imperial Kitten, named after the Liderc malware family — a custom .NET implant that uses IMAP email protocols for command and control. PwC documented Yellow Liderc conducting strategic web compromise operations targeting Israeli maritime and technology organizations, as well as direct phishing campaigns against defense-adjacent targets. The cluster's distinctive use of email-based C2 and focus on Israeli and Middle Eastern targets aligns precisely with CrowdStrike's Imperial Kitten and Symantec's Tortoiseshell tracking of the same IRGC-linked actor.