InfoSecBulletin Cybersecurity for mankind
Trellix Advanced Research Center (ARC) found a campaign targeting a European embassy in New Delhi, India. Further investigation uncovered multiple targeted institutions across Sri Lanka, Pakistan, and Bangladesh.
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
This report analyzes the tactics used by SideWinder, an APT group known for espionage in Asia. The investigation shows that SideWinder has evolved its methods, now using a new infection chain involving PDFs and ClickOnce, alongside their older Microsoft Word exploits. This change reflects their efforts to bypass standard security measures.
Email phishing lures and activity timeline:
The phishing campaign in 2025 had several waves, each targeting specific Asian diplomatic entities with unique themes. Its aim was to install ModuleInstaller and StealerBot malware for espionage.
The first round of emails occurred during March and April, targetingBangladeshi institutions with documents titled “Registration Form.pdf”, “Hajj training 2025.pdf”, or “Integrated Hajj Medical Team 2025.pdf”. To view the content of the files, the victim had to download the “latest Adobe Reader version” by clicking the button present in the document. The domains used to download the malicious Adobe Reader update included references to organizations and events from Bangladesh, such as the Cadet College, military high school, or the Hajj pilgrimage.
hajjtraining2025[.]moragovt[.]net
cadetcollege[.]adobeglobal[.]com
hajjmedicalteam[.]adobeglobal[.]com
The second wave of phishing emails targeted Pakistani diplomats from April to August 2025, using fake Adobe Reader updates and malicious Word documents.
pimec-paknavy[.]updates-installer[.]store
cabinet-gov-pk[.]dytt888[.]net
adobe[.]pdf-downlod[.]com
The third phase happened from June to September and involved phishing emails aimed at Sri Lankan authorities, using documents like “Annual Transfers of Officers in the Joint Services 2026.pdf” and “Promotion of officers in Grade I.pdf”. Both used the same method as phase one. Below is a list of domains for the next stages.
www-treasury-gov-lk[.]snagdrive[.]com
pubad-gov-lk[.]download-doc[.]net
“The multi-wave phishing campaigns demonstrate the group’s adaptability in crafting highly specific lures for various diplomatic targets, indicating a sophisticated understanding of geopolitical contexts,” Trellix said. “The consistent use of custom malware, such as ModuleInstaller and StealerBot, coupled with the clever exploitation of legitimate applications for side-loading, underscores SideWinder’s commitment to sophisticated evasion techniques and espionage objectives.”
CIRT Alert RCE Vulnerability in Microsoft WSUS in Bangladesh
