Loading story…
Trellix reported that the SideWinder threat group is using Microsoft ClickOnce deployment as part of an espionage campaign, marking a shift in delivery technique for a long-running cyber-espionage actor. The activity indicates a continued focus on stealthy initial access and execution methods that can blend into legitimate Windows and enterprise software workflows, helping the group deliver malicious payloads while reducing suspicion among targeted users.
The campaign reflects SideWinder’s ongoing adaptation of tradecraft to support intelligence collection against selected targets. By leveraging a trusted application deployment mechanism rather than more conventional malware lures alone, the operators appear to be refining persistence and execution pathways in ways that complicate detection and response for defenders monitoring phishing, endpoint execution, and abuse of legitimate Microsoft technologies.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Trellix published a research blog detailing SideWinder espionage tradecraft involving ClickOnce, describing the campaign and its observed techniques. No earlier discrete real-world events are provided in the reference content.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **SideWinder** espionage group, also tracked as **RagaSerpent** and suspected to be India-linked, has expanded targeted operations across Southeast Asia, including **Thailand** and **Indonesia**, with victims spanning government, telecommunications, critical infrastructure, maritime, logistics, and nuclear-sector organizations. Reporting indicates the campaign remains focused on intelligence collection and long-term access rather than disruption, with operators using spear-phishing, stolen credentials, older Microsoft Office vulnerabilities, and DLL hijacking to gain entry into victim environments. Researchers said the group offsets these relatively simple intrusion methods with disciplined post-compromise tradecraft, including staged payload delivery, persistence through Windows services, and rapidly rotating command-and-control infrastructure. A notable feature of recent activity is malware that derives its C2 configuration dynamically at runtime, allowing operators to shift infrastructure without rebuilding payloads and complicating remediation. Separate reporting also links **RagaSerpent** to a multi-country targeted intrusion chain described as a SideWinder-adjacent **"Tax Audit"** cluster, reinforcing concerns that the threat actor is sustaining broad regional espionage activity and pre-positioning inside networks for strategic access.
Jun 29, 2026
SideWinder, a known advanced persistent threat (APT) group, has launched a sophisticated spear-phishing campaign targeting diplomatic and governmental organizations in South Asia, including a European embassy in New Delhi and entities in Sri Lanka, Pakistan, and Bangladesh. The group has evolved its tactics by adopting a novel infection chain that leverages PDF and ClickOnce-based payloads, in addition to previously used Microsoft Word exploits, to deliver malware such as ModuleInstaller and StealerBot. These attacks, observed in multiple waves from March through September 2025, are designed to compromise sensitive systems and exfiltrate confidential data. The StealerBot malware, a .NET-based implant, is capable of launching reverse shells, delivering additional payloads, and harvesting a wide range of information including screenshots, keystrokes, passwords, and files from infected hosts. ModuleInstaller acts as a downloader for subsequent malicious components. This campaign demonstrates a significant evolution in SideWinder's tactics, techniques, and procedures (TTPs), with phishing emails crafted to appear as official diplomatic communications, using document titles referencing inter-ministerial meetings and regional conflicts. The campaign underscores the persistent threat posed by SideWinder to South Asian diplomatic and governmental targets through advanced social engineering and malware delivery techniques.
Jul 12, 2026
Group-IB reported renewed activity by **APT SideWinder**, describing a sustained cyber-espionage campaign aimed at government, military, and maritime organizations across Asia. The operation was characterized by targeted intrusion activity and a recognizable tradecraft pattern that researchers said allowed them to track the actor across multiple incidents. The report said SideWinder continued to rely on spearphishing and malware delivery techniques tailored to regional targets, reinforcing the group’s role as a persistent intelligence threat rather than a financially motivated actor. Group-IB’s findings highlight SideWinder’s ongoing focus on sensitive institutions and critical sectors, with the campaign showing consistent operational behavior that supports attribution and threat hunting efforts.
Jul 12, 2026