Yellow Liderc's Multi-Faceted Cyber Campaign Targets Global Industries

The cyber threat group known as Yellow Liderc has been compromising legitimate websites and sending deceptive phishing emails to break into organizational networks. Once inside, they deploy a new, specialized malicious software named "IMAPLoader" to spy on systems and steal corporate data.

The attacks are directed by Yellow Liderc, an advanced threat group known for exploiting legitimate web infrastructure and utilizing common webmail services, specifically Yandex, to secretly control their malware.

The main goals are to secretly gain access to corporate networks, gather detailed information about infected computers, and install further malicious software. The group uses a combination of fake login pages to steal account credentials and stealthy software injection techniques to stay hidden.

The campaign heavily targets the maritime, shipping, and logistics sectors within the Mediterranean region, alongside European travel and hospitality industries. These sectors are highly attractive to attackers because they handle valuable global supply chain data, operations, and sensitive organizational information.

Attackers modified legitimate websites to scan visitors and deliver malware specifically to high-value targets. They also sent targeted emails containing deceptive Excel files that, when opened, tricked the computer into running malicious code hidden inside normal, everyday Microsoft applications.

It is a combination of both. While their highly advanced malware operations specifically target the shipping and maritime industries in the Mediterranean, their phishing and password-stealing operations are more widespread, impacting various travel, hospitality, and Microsoft ecosystem users across Europe.