Loading story…
Group-IB identified 61 targets in SideWinder’s 2021 phishing operations across Afghanistan, Bhutan, Myanmar, Nepal, and Sri Lanka, spanning government, military, financial, law enforcement, and political sectors. Analysis of backup archives exposed phishing projects with fake websites impersonating the Central Bank of Myanmar. Cryptocurrency-themed lures also suggested growing interest in the cryptocurrency industry, although they did not establish successful compromises in that sector.
The research documented previously unreported SideWinder tools and the use of Telegram to receive malware command results, highlighting the need to monitor messaging-service traffic alongside impersonation-based phishing. Group-IB assessed BabyElephant and SideWinder as most likely the same or closely related APT groups and attributed a successful 2020 attack on the Maldivian government to SideWinder. Organizations in the targeted sectors should prioritize detection of fraudulent institutional websites and investigate unexpected Telegram communications from endpoints.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Group-IB published research describing previously undocumented SideWinder tools, its use of Telegram to receive malware command results, and YARA rules for threat hunting. The report assessed BabyElephant and SideWinder as most likely the same or closely related groups and attributed the 2020 Maldivian government attack to SideWinder.
SideWinder conducted a 2021 phishing campaign with 61 identified targets across government, military, financial, law enforcement, and political sectors in Afghanistan, Bhutan, Myanmar, Nepal, and Sri Lanka. Archived phishing projects included fake Central Bank of Myanmar websites and cryptocurrency-themed lures.
A successful attack targeted the Maldivian government in 2020. Group-IB subsequently attributed the attack to SideWinder.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Group-IB reported renewed activity by **APT SideWinder**, describing a sustained cyber-espionage campaign aimed at government, military, and maritime organizations across Asia. The operation was characterized by targeted intrusion activity and a recognizable tradecraft pattern that researchers said allowed them to track the actor across multiple incidents. The report said SideWinder continued to rely on spearphishing and malware delivery techniques tailored to regional targets, reinforcing the group’s role as a persistent intelligence threat rather than a financially motivated actor. Group-IB’s findings highlight SideWinder’s ongoing focus on sensitive institutions and critical sectors, with the campaign showing consistent operational behavior that supports attribution and threat hunting efforts.
Jul 12, 2026
The **SideWinder** APT group has intensified espionage operations across South Asia, targeting government, military, and public-sector entities in countries including **Sri Lanka, Bangladesh, and Pakistan**. Researchers reported spear-phishing campaigns using malicious Word and RTF documents that exploited `CVE-2017-0199` and `CVE-2017-11882`, alongside geofenced delivery, shellcode loaders, server-side polymorphism, and DLL sideloading to limit payloads to intended victims and evade analysis. Confirmed targets included the **Central Bank of Sri Lanka** and the **Sri Lanka Army’s 55th Division Battalion**, with infrastructure such as `army-govbd[.]info` supporting multi-stage infections that ultimately deployed **StealerBot** for credential theft, reconnaissance, persistence, and data exfiltration. Separate reporting tied SideWinder to a newer Pakistan-focused campaign delivering a backdoor called **WarHawk** through malicious ISO files hosted on Pakistan’s **National Electric Power Regulatory Authority** website and lures copied from legitimate Cabinet Division advisories. WarHawk profiled infected systems, executed commands, enumerated files, and transferred additional payloads, including a custom **Cobalt Strike** loader that used **KernelCallbackTable injection** and a Pakistan Standard Time check to constrain execution. Earlier research also linked SideWinder to Android spyware distributed through **Google Play** as fake VPN, cleaning, and religious apps, showing the group’s broader use of mobile and desktop malware, reused infrastructure, and regionally tailored delivery to sustain long-running intelligence collection in South Asia.
Aug 15, 2026
SideWinder, a known advanced persistent threat (APT) group, has launched a sophisticated spear-phishing campaign targeting diplomatic and governmental organizations in South Asia, including a European embassy in New Delhi and entities in Sri Lanka, Pakistan, and Bangladesh. The group has evolved its tactics by adopting a novel infection chain that leverages PDF and ClickOnce-based payloads, in addition to previously used Microsoft Word exploits, to deliver malware such as ModuleInstaller and StealerBot. These attacks, observed in multiple waves from March through September 2025, are designed to compromise sensitive systems and exfiltrate confidential data. The StealerBot malware, a .NET-based implant, is capable of launching reverse shells, delivering additional payloads, and harvesting a wide range of information including screenshots, keystrokes, passwords, and files from infected hosts. ModuleInstaller acts as a downloader for subsequent malicious components. This campaign demonstrates a significant evolution in SideWinder's tactics, techniques, and procedures (TTPs), with phishing emails crafted to appear as official diplomatic communications, using document titles referencing inter-ministerial meetings and regional conflicts. The campaign underscores the persistent threat posed by SideWinder to South Asian diplomatic and governmental targets through advanced social engineering and malware delivery techniques.
Jul 12, 2026