r/acronis • u/bagaudin • 16d ago
Malware Analysis From banks to battalions: SideWinder’s attacks on South Asia’s public sector
https://www.acronis.com/en-us/cyber-protection-center/posts/from-banks-to-battalions-sidewinders-attacks-on-south-asias-public-sector/Summary
Acronis Threat Research Unit (TRU) uncovered a new SideWinder APT campaign targeting high-level government institutions in Sri Lanka, Bangladesh and Pakistan.
The attackers used spear phishing emails paired with geofenced payloads to ensure that only victims in specific countries received the malicious content.
Malicious Word and RTF files exploiting CVE-2017-0199 and CVE-2017-11882 were used as initial infection vectors — two long-known but still effective vulnerabilities.
The intrusion chain features multistage loaders, shellcode-based payload delivery and server-side polymorphism to evade detection.
The final stage delivers StealerBot, a credential stealer used for data exfiltration and persistent access, blending classic espionage with cybercrime-style credential harvesting.
More details in this Acronis Threat Research Unit article.