Loading story…
Researchers reported that SideWinder ran a five-month credential-harvesting campaign against South Asian military, government, telecommunications, and defense-sector organizations by abusing legitimate PaaS infrastructure instead of traditional attacker-controlled hosting. The operation used about 20 infrastructure nodes across Zeabur, Leapcell, Railway, Cloudflare Workers, Replit, Back4App, and URL shorteners including short.gy and tinyurl.cx, with many phishing assets hosted on free-tier subdomains that could be quickly rebuilt after takedowns. Breakglass Intelligence linked the activity with high confidence to SideWinder based on targeting, Zimbra-themed phishing tradecraft, lure themes, and overlap with prior operations.
The campaign targeted entities in Pakistan and Bangladesh, including Margalla Heavy Industries Limited, Bangladesh Navy, Pakistan Air Force, Nayatel, Bangladesh Computer Council, NTC Pakistan, and an unidentified international relations organization. Investigators said the attackers used a five-stage phishing chain with cloned Zimbra login pages that stole the same victim’s password twice, and they decoded a victim address, pgcoord-251@margallahil[.]com, from a phishing URL tied to Margalla Heavy Industries. A reused query parameter appeared across all phishing URLs for five months, giving defenders a potential detection signature, while two Zeabur-hosted phishing sites remained active and harvesting credentials at the time of reporting.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
As of 2026-04-05, researchers reported that two Zeabur-hosted phishing sites tied to the campaign were still live and actively harvesting credentials. This showed the infrastructure remained operational despite the broader investigation into the campaign.
By April 2026, Breakglass Intelligence assessed with high confidence that the activity was conducted by SideWinder based on targeting patterns, Zimbra credential-phishing tradecraft, lure themes, and overlap with previously reported SideWinder operations. The researchers described the campaign as part of the group's broader 2026 activity across diplomacy, civilian government, military, defense industry, and telecommunications in at least four countries.
During the campaign, SideWinder used a multi-stage Zimbra-themed phishing flow that harvested the same victim's password twice through separate credential pages impersonating organizations such as Bangladesh Navy and Pakistan Air Force. Researchers also found a reused query parameter across all phishing URLs for five months, which they assessed as a strong detection signature.
In November 2025, a URLScan capture revealed a phishing URL containing a base64-decoded email address for a project coordinator at Margalla Heavy Industries Limited, linking the campaign to a confirmed Pakistani defense-sector victim. Breakglass later identified the address as pgcoord-251@margallahil[.]com.
Between November 2025 and April 2026, researchers observed SideWinder running a credential-harvesting campaign against military, government, telecom, and defense-sector organizations in Pakistan and Bangladesh using legitimate PaaS infrastructure and URL shorteners. The operation ultimately spanned 20 infrastructure nodes across providers including Zeabur, Leapcell, Railway, Cloudflare Workers, Replit, Back4App, short.gy, and tinyurl.cx.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
intel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SideWinder, a known advanced persistent threat (APT) group, has launched a sophisticated spear-phishing campaign targeting diplomatic and governmental organizations in South Asia, including a European embassy in New Delhi and entities in Sri Lanka, Pakistan, and Bangladesh. The group has evolved its tactics by adopting a novel infection chain that leverages PDF and ClickOnce-based payloads, in addition to previously used Microsoft Word exploits, to deliver malware such as ModuleInstaller and StealerBot. These attacks, observed in multiple waves from March through September 2025, are designed to compromise sensitive systems and exfiltrate confidential data. The StealerBot malware, a .NET-based implant, is capable of launching reverse shells, delivering additional payloads, and harvesting a wide range of information including screenshots, keystrokes, passwords, and files from infected hosts. ModuleInstaller acts as a downloader for subsequent malicious components. This campaign demonstrates a significant evolution in SideWinder's tactics, techniques, and procedures (TTPs), with phishing emails crafted to appear as official diplomatic communications, using document titles referencing inter-ministerial meetings and regional conflicts. The campaign underscores the persistent threat posed by SideWinder to South Asian diplomatic and governmental targets through advanced social engineering and malware delivery techniques.
Jul 12, 2026
The **SideWinder** espionage group, also tracked as **RagaSerpent** and suspected to be India-linked, has expanded targeted operations across Southeast Asia, including **Thailand** and **Indonesia**, with victims spanning government, telecommunications, critical infrastructure, maritime, logistics, and nuclear-sector organizations. Reporting indicates the campaign remains focused on intelligence collection and long-term access rather than disruption, with operators using spear-phishing, stolen credentials, older Microsoft Office vulnerabilities, and DLL hijacking to gain entry into victim environments. Researchers said the group offsets these relatively simple intrusion methods with disciplined post-compromise tradecraft, including staged payload delivery, persistence through Windows services, and rapidly rotating command-and-control infrastructure. A notable feature of recent activity is malware that derives its C2 configuration dynamically at runtime, allowing operators to shift infrastructure without rebuilding payloads and complicating remediation. Separate reporting also links **RagaSerpent** to a multi-country targeted intrusion chain described as a SideWinder-adjacent **"Tax Audit"** cluster, reinforcing concerns that the threat actor is sustaining broad regional espionage activity and pre-positioning inside networks for strategic access.
Jun 29, 2026
Arctic Wolf reported an **India-nexus espionage campaign** attributed to **SloppyLemming** (aka *Outrider Tiger* / *Fishing Elephant*) targeting government entities and critical infrastructure operators in **Pakistan and Bangladesh** (with additional reporting noting **Sri Lanka**). The activity, tracked from **January 2025 to January 2026**, used two main infection chains: (1) **PDF lure documents** that redirected victims to **ClickOnce** manifests, deploying a **DLL sideloading** package using a legitimate `.NET` runtime executable (`NGenTask.exe`) alongside a malicious loader (`mscorsvc.dll`) that decrypted and executed a custom x64 shellcode implant dubbed **BurrowShell**; and (2) **macro-enabled Excel** lures delivering a **Rust-based** keylogger/recon tool with capabilities including port scanning and network enumeration. BurrowShell was described as a full-featured backdoor enabling file operations, screenshot capture, remote shell execution, and **SOCKS proxy** tunneling, while attempting to blend in by masquerading C2 as **Windows Update** traffic and using **RC4** with a 32-character key for payload protection. Infrastructure analysis tied the campaign to **112 Cloudflare Workers domains** registered during the tracking period—an expansion in scale compared to prior public reporting—and included government-themed domain naming intended to increase victim trust. Reported targets included Pakistani nuclear regulatory and defense-adjacent organizations (e.g., the **Pakistan Nuclear Regulatory Authority**, **Pakistan Navy**, and logistics/telecom entities) and Bangladeshi energy and financial-sector organizations (including power grid/utility operators). Arctic Wolf assessed the actor as moderately capable, citing multi-stage execution and defense evasion knowledge alongside operational security lapses (e.g., exposed directories), and noted the activity as an expansion of threat activity previously identified publicly by Cloudflare.
Jun 29, 2026