Free, Unbiased, and Open threat intelligence
Free, Unbiased, and Open threat intelligence
threat Profile
Multi-wave espionage campaign by SideWinder APT group targeting governmental entities in South Asia (India, Pakistan, Bangladesh, Sri Lanka) from March to September 2025. The campaign employed novel PDF and ClickOnce-based infection chains alongside traditional Word exploit vectors to deploy ModuleInstaller and StealerBot malware. Threat actors used sophisticated evasion techniques including geofencing, polymorphism, dynamic URLs, and time-locked payload delivery. The campaign targeted diplomatic institutions and government officials with highly specific phishing lures themed around regional political events, religious ceremonies (Hajj), military appointments, and inter-ministerial meetings. Attackers leveraged legitimate MagTek Reader Configuration application for DLL sideloading, maintaining valid certificate chains to evade detection while delivering multi-stage malware payloads.
Threat Actors
CVEs
Published
7 months ago
Views
2