Trellix Advanced Research Center (ARC) found a campaign targeting a European embassy in New Delhi, India. Further investigation uncovered multiple targeted institutions across Sri Lanka, Pakistan, and Bangladesh.
This report analyzes the tactics used by SideWinder, an APT group known for espionage in Asia. The investigation shows that SideWinder has evolved its methods, now using a new infection chain involving PDFs and ClickOnce, alongside their older Microsoft Word exploits. This change reflects their efforts to bypass standard security measures.
Email phishing lures and activity timeline:
The phishing campaign in 2025 had several waves, each targeting specific Asian diplomatic entities with unique themes. Its aim was to install ModuleInstaller and StealerBot malware for espionage.
The first round of emails occurred during March and April, targetingBangladeshi institutions with documents titled “Registration Form.pdf”, “Hajj training 2025.pdf”, or “Integrated Hajj Medical Team 2025.pdf”. To view the content of the files, the victim had to download the “latest Adobe Reader version” by clicking the button present in the document. The domains used to download the malicious Adobe Reader update included references to organizations and events from Bangladesh, such as the Cadet College, military high school, or the Hajj pilgrimage.
hajjtraining2025[.]moragovt[.]net
cadetcollege[.]adobeglobal[.]com
hajjmedicalteam[.]adobeglobal[.]com
The second wave of phishing emails targeted Pakistani diplomats from April to August 2025, using fake Adobe Reader updates and malicious Word documents.
pimec-paknavy[.]updates-installer[.]store
cabinet-gov-pk[.]dytt888[.]net
adobe[.]pdf-downlod[.]com
The third phase happened from June to September and involved phishing emails aimed at Sri Lankan authorities, using documents like “Annual Transfers of Officers in the Joint Services 2026.pdf” and “Promotion of officers in Grade I.pdf”. Both used the same method as phase one. Below is a list of domains for the next stages.
www-treasury-gov-lk[.]snagdrive[.]com
pubad-gov-lk[.]download-doc[.]net
“The multi-wave phishing campaigns demonstrate the group’s adaptability in crafting highly specific lures for various diplomatic targets, indicating a sophisticated understanding of geopolitical contexts,” Trellix said. “The consistent use of custom malware, such as ModuleInstaller and StealerBot, coupled with the clever exploitation of legitimate applications for side-loading, underscores SideWinder’s commitment to sophisticated evasion techniques and espionage objectives.”
CIRT Alert RCE Vulnerability in Microsoft WSUS in Bangladesh