SideWinder Adopts New ClickOnce-Based Attack Chain Targeting South Asian Diplomats - The Hacker News

SideWinder Adopts New ClickOnce-Based Attack Chain Targeting South Asian Diplomats Ravie LakshmananOct 28, 2025Cyber Espionage / Malware A European embassy located in the Indian capital of New Delhi, as well as multiple organizations in Sri Lanka, Pakistan, and Bangladesh, have emerged as the target of a new campaign orchestrated by a threat actor known as SideWinder in September 2025. The activity "reveals a notable evolution in SideWinder's TTPs, particularly the adoption of a novel PDF and ClickOnce-based infection chain, in addition to their previously documented Microsoft Word exploit vectors," Trellix researchers Ernesto Fernández Provecho and Pham Duy Phuc said in a report published last week. The attacks, which involved sending spear-phishing emails in four waves from March through September 2025, are designed to drop malware families such as ModuleInstaller and StealerBot to gather sensitive information from compromised hosts. While ModuleInstaller serves as a downloader for next-stage payloads, including StealerBot, the latter is a .NET implant that can launch a reverse shell, deliver additional malware, and collect a wide range of data from compromised hosts, including screenshots, keystrokes, passwords, and files. It should be noted that both ModuleInstaller and StealerBot were first publicly documented by Kaspersky in October 2024 as part of attacks mounted by the hacking group targeting high-profile entities and strategic infrastructures in the Middle East and Africa. As recently as May 2025, Acronis revealed SideWinder's attacks aimed at government institutions in Sri Lanka, Bangladesh, and Pakistan using malware-laden documents susceptible to known Microsoft Office flaws to launch a multi-stage attack chain and ultimately deliver StealerBot. The latest set of attacks, observed by Trellix post September 1, 2025, and targeting Indian embassies, entails the use of Microsoft Word and PDF documents in phishing emails with titles such as "Inter-ministerial meeting Credentials.pdf" or "India-Pakistan Conflict -Strategic and Tactical Analysis of the May 2025.docx." The messages are sent from the domain "mod.gov.bd.pk-mail[.]org" in an attempt to mimic the Ministry of Defense of Pakistan. "The initial infection vector is always the same: a PDF file that cannot be properly seen by the victim or a Word document that contains some exploit," Trellix said. "The PDF files contain a button that urges the victim to download and install the latest version of Adobe Reader to view the document's content." Doing so, however, triggers the download of a ClickOnce application from a remote server ("mofa-gov-bd.filenest[.]live"), which, when launched, sideloads a malicious DLL ("DEVOBJ.dll"), while simultaneously launching a decoy PDF document to the victims. The ClickOnce application is a legitimate executable from MagTek Inc. ("ReaderConfiguration.exe") that masquerades as Adobe Reader and is signed with a valid signature to avoid raising any red flags. Furthermore, requests to the command-and-control (C2) server are region-locked to South Asia and the path to download the payload is dynamically generated, complicating analysis efforts. The rogue DLL, for its part, is designed to decrypt and launch a .NET loader named ModuleInstaller, which then proceeds to profile the infected system and deliver the StealerBot malware. The findings indicate an ongoing effort on the part of the persistent threat actors to refine their modus operandi and circumvent security defenses to accomplish their goals. "The multi-wave phishing campaigns demonstrate the group's adaptability in crafting highly specific lures for various diplomatic targets, indicating a sophisticated understanding of geopolitical contexts," Trellix said. "The consistent use of custom malware, such as ModuleInstaller and StealerBot, coupled with the clever exploitation of legitimate applications for side-loading, underscores SideWinder's commitment to sophisticated evasion techniques and espionage objectives." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share SHARE  Advanced Persistent Threat, cyber espionage, cybersecurity, Malware, Microsoft office, Phishing, Threat Intelligence ⚡ Top Stories This Week China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade Agentjacking Attack Tricks AI Coding Agents Into Running Malicious Code Palo Alto Warns of Active Exploitation of PAN-OS GlobalProtect VPN Flaw Researchers Build Self-Replicating AI Worm That Operates Entirely on Local, Open-Weight Models Ivanti, Fortinet, and SAP Release Patches for Multiple Critical Vulnerabilities Anthropic Releases Claude Fable 5, Its Most Powerful AI Yet, With Cyber Safeguards Critical Splunk Enterprise Flaw Lets Attackers Run Code Without Authentication Cybersecurity Stars Awards 2026: Winners Announced Across 95 Categories Chrome V8 Zero-Day CVE-2026-11645 Exploited in the Wild - Patch Now Microsoft Defender RoguePlanet Zero-Day Grants SYSTEM Access on Updated Windows U.S. Orders Anthropic to Suspend Fable 5 and Mythos 5 Access for Foreign Nationals Microsoft Patches Record 206 Flaws, Including Three Zero-Days and Critical RCE Bugs New GreatXML Exploit Bypasses Windows BitLocker via Recovery Partition XML Files ThreatsDay Bulletin: Worm Code Leaked, AI Agent Phished, Claude Code Patch + 28 New Stories ⚡ Weekly Recap: Chrome 0-Day, UniFi Exploits, macOS Stealers, VPN Flaw and More Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit Load More ▼ ⭐ Featured Resources AI Can’t Stop Every Attack. Learn How Zero Trust Can Block What’s Unknown Get the 2026 Guide to Govern and Secure Enterprise AI Agents at Scale Have You Outgrown Your MDR? 7 Warning Signs Every CISO Should Check [Watch Demo] See Which Security Gaps Attackers Could Exploit First