Loading story…
SideWinder, a known advanced persistent threat (APT) group, has launched a sophisticated spear-phishing campaign targeting diplomatic and governmental organizations in South Asia, including a European embassy in New Delhi and entities in Sri Lanka, Pakistan, and Bangladesh. The group has evolved its tactics by adopting a novel infection chain that leverages PDF and ClickOnce-based payloads, in addition to previously used Microsoft Word exploits, to deliver malware such as ModuleInstaller and StealerBot. These attacks, observed in multiple waves from March through September 2025, are designed to compromise sensitive systems and exfiltrate confidential data.
The StealerBot malware, a .NET-based implant, is capable of launching reverse shells, delivering additional payloads, and harvesting a wide range of information including screenshots, keystrokes, passwords, and files from infected hosts. ModuleInstaller acts as a downloader for subsequent malicious components. This campaign demonstrates a significant evolution in SideWinder's tactics, techniques, and procedures (TTPs), with phishing emails crafted to appear as official diplomatic communications, using document titles referencing inter-ministerial meetings and regional conflicts. The campaign underscores the persistent threat posed by SideWinder to South Asian diplomatic and governmental targets through advanced social engineering and malware delivery techniques.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Researchers reported that the SideWinder APT shifted to a new attack chain using PDF lures and Microsoft ClickOnce to target diplomatic entities in South Asia. The campaign was described as delivering StealerBot as part of the intrusion workflow.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **SideWinder** APT group has intensified espionage operations across South Asia, targeting government, military, and public-sector entities in countries including **Sri Lanka, Bangladesh, and Pakistan**. Researchers reported spear-phishing campaigns using malicious Word and RTF documents that exploited `CVE-2017-0199` and `CVE-2017-11882`, alongside geofenced delivery, shellcode loaders, server-side polymorphism, and DLL sideloading to limit payloads to intended victims and evade analysis. Confirmed targets included the **Central Bank of Sri Lanka** and the **Sri Lanka Army’s 55th Division Battalion**, with infrastructure such as `army-govbd[.]info` supporting multi-stage infections that ultimately deployed **StealerBot** for credential theft, reconnaissance, persistence, and data exfiltration. Separate reporting tied SideWinder to a newer Pakistan-focused campaign delivering a backdoor called **WarHawk** through malicious ISO files hosted on Pakistan’s **National Electric Power Regulatory Authority** website and lures copied from legitimate Cabinet Division advisories. WarHawk profiled infected systems, executed commands, enumerated files, and transferred additional payloads, including a custom **Cobalt Strike** loader that used **KernelCallbackTable injection** and a Pakistan Standard Time check to constrain execution. Earlier research also linked SideWinder to Android spyware distributed through **Google Play** as fake VPN, cleaning, and religious apps, showing the group’s broader use of mobile and desktop malware, reused infrastructure, and regionally tailored delivery to sustain long-running intelligence collection in South Asia.
Aug 15, 2026
A sophisticated phishing campaign targeting Indian entities has been attributed to the SideWinder advanced persistent threat group. Attackers impersonate the Indian Income Tax Department by sending tax-themed emails that urge recipients to review an inspection document. These emails contain links to a fake tax portal closely mimicking the legitimate government site, which then delivers a malicious ZIP archive. The archive includes a renamed, signed Microsoft Defender binary and a malicious DLL, exploiting DLL side-loading to install a Windows backdoor. The malware performs geofencing by checking the victim's timezone and only proceeds if it matches South Asian regions, thereby targeting Indian organizations specifically. Once installed, the backdoor enables file theft, data capture, and remote control by the attackers, with connections observed to known SideWinder command-and-control servers. Security researchers have noted a surge in tax-themed phishing and malware campaigns during the Indian tax filing season, leveraging public discussions about refunds to increase credibility. The spear-phishing emails often originate from suspicious domains and use embedded images to bypass spam filters, further enhancing their effectiveness. The infection chain is multi-stage, ultimately deploying persistent remote access trojans or infostealers. These campaigns highlight the evolving tactics of threat actors in targeting Indian businesses and government-related entities through highly convincing social engineering and technical subterfuge.
Jun 29, 2026
Researchers traced a **SideWinder** spearphishing campaign to a malicious Word document named **"Briefing on Ongoing Projects.docx"** that fetched a remote RTF template from a spoofed domain and exploited Microsoft Equation Editor via `CVE-2017-11882`. The recovered RTF decrypted embedded JavaScript, launched an obfuscated script, and executed a .NET component that profiled installed antivirus products before attempting to download a further payload stage. Investigators found the originally malicious RTF had later been replaced with a nearly empty placeholder file, a tactic that obscured follow-on analysis while preserving infrastructure clues. Additional infrastructure and tradecraft links tied the activity to broader South Asian espionage patterns involving malicious RTF lures, Equation Editor exploitation, and multi-stage loaders. Fortinet separately documented a spearphishing attack against a telecommunications agency in South Asia using an RTF lure that exploited `CVE-2018-0798`, abused **Logitech** DLL search order hijacking with a signed executable and malicious `LBTServ.dll`, injected into `svchost.exe`, and contacted `instructor[.]giize[.]com` to retrieve a payload linked through OSINT to **PoisonIvy RAT**. Across the references, the campaigns show consistent use of document-based initial access, obfuscated intermediate stages, and reusable infrastructure and tooling associated with long-running regional espionage operations.
Aug 15, 2026