Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Prior Acronis TRU reporting confirms SideWinder chains CVE-2017-0199 with CVE-2017-11882 (Equation Editor memory corruption) to deliver multistage shellcode loaders culminating in the StealerBot credential-harvesting implant
Notably, the attackers continue to exploit the Microsoft Office Remote Template Injection vulnerability (CVE-2017-0199) ... Kit 2 — CVE-2017-0199 OLE2Link Exploitation ... OLE2Link exploit (CVE-2017-0199, patched by Microsoft in April 2017) | Prior Acronis TRU reporting confirms SideWinder chains CVE-2017-0199 with CVE-2017-11882 (Equation Editor memory corruption) to deliver multistage shellcode loaders culminating in the StealerBot credential-harvesting implant
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Prior Acronis TRU reporting confirms SideWinder chains CVE-2017-0199 with CVE-2017-11882 (Equation Editor memory corruption) to deliver multistage shellcode loaders culminating in the StealerBot credential-harvesting implant
27 distinct techniques documented for this family, organized by ATT&CK tactic.
By default, the malware starts a new “cmd.exe” process, forwards data received from the attacker to its standard input, and forwards the process output or error pipeline to the attacker.
The remote HTA embeds a heavily obfuscated JavaScript file... strings, initially encoded with a substitution algorithm... embedded within its code as a base64-encoded .NET serialized stream.
the embedded JavaScript runs the Windows utility mshta . exe and obtains additional code from a remote server
The RTF delivery includes server-side geofencing (likely IP-based victim filtering) and User-Agent validation requiring legitimate Microsoft Office strings, ensuring that sandboxes and researchers receive decoy content or 404s.
A separate credential-harvesting infrastructure cluster impersonated the Directorate General of Defence Purchase (DGDP), Directorate General of Forces Intelligence (DGFI), Bangladesh Air Force (BAF), Bangladesh Ordnance Factories (BOF), the national webmail portal (mail.gov.bd), and Bangladesh Police, funneling stolen credentials to centralized backend collection domains
This module uses the “SetWindowsHookEx” function specified in the “user32.dll” library to install a hook procedure and monitor low-level keyboard and mouse input events. The malware can log keystrokes...
The module is a .NET library designed to steal Google Chrome browser cookies and authentication tokens related to Facebook, LinkedIn and Google services...
The File Stealer module collects files from specific directories. It also scans removable drives to steal files with specific extensions.
It also scans removable drives to steal files with specific extensions.
A separate credential-harvesting infrastructure cluster impersonated the Directorate General of Defence Purchase (DGDP), Directorate General of Forces Intelligence (DGFI), Bangladesh Air Force (BAF), Bangladesh Ordnance Factories (BOF), the national webmail portal (mail.gov.bd), and Bangladesh Police, funneling stolen credentials to centralized backend collection domains
A single MD5 hash and a filename... Behind that hash was a SideWinder APT command-and-control domain hosting four simultaneous espionage campaigns...
SideWinder (APT-C-17) is suspected to have links to India and is known for its multi-stage cyberattack campaigns in the Middle East.
218 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A SideWinder-exclusive modular in-memory espionage framework used as the final payload. Recovered modules include keylogging, reverse shell access, screenshot capture, file theft, UAC bypass, RDP credential theft, token grabbing from browsers and online services, and credential phishing via spoofed Windows credential prompts.
A custom post-exploitation malware/tool used by SideWinder in multi-stage campaigns, apparently for follow-on access and theft activities.
A modular .NET espionage implant used post-compromise by SideWinder. It is loaded in memory by a backdoor loader and managed by an Orchestrator component that communicates with C2 to load plugins. Observed capabilities include installing additional malware, capturing screenshots, keylogging, stealing browser passwords and tokens, intercepting RDP credentials, stealing files, launching a reverse shell/live console, phishing Windows credentials, and bypassing UAC.
A sophisticated in-memory implant and private post-exploitation toolkit used exclusively by SideWinder for espionage-oriented operations. In this campaign it is loaded into memory by Backdoor Loader, and the article notes the implant itself remained unchanged while loader variants evolved.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.