Thursday , April 24 2025
BGD eGOV CIRT

BD CIRT REPORT
Ongoing Phishing Campaign targeting Bangladesh by APT group SideWinder

Cyber Threat Intelligence Unit of BGD e-GOV CIRT has detected a suspicious ongoing phishing campaign by APT group named as SideWinder targeted at Bangladeshi entities such as Bangladesh Armed Forces Division (AFD) and Law Enforcement Agencies.

The group is known as a highly active hacker group who has shown the capability to conductseveral attacks within a short time span and poses threats to organizations in South and East Asia. This alert includes an extensive list of IOCs and the group TTPs in order to help Bangladeshi organizations in taking preventive security measures accordingly. In Primary investigation we noticed that the main target of this APT group is to steal sensitive, confidential and classified documents.

SonicWall patched SSLVPN Vuln Allowing Firewall Crashing

SonicWall has revealed a vulnerability in its SonicOS SSLVPN Virtual Office interface that could let remote attackers crash firewall appliances....
Read More
SonicWall patched SSLVPN Vuln Allowing Firewall Crashing

GitLab Releases Security Update For Multiple Vulns

GitLab has announced a security advisory urging users to upgrade their self-managed installations right away. Versions 17.11.1, 17.10.5, and 17.9.7...
Read More
GitLab Releases Security Update For Multiple Vulns

ISPAB president “whatsapp” got hacked via phishing link

Imdadul Haque, the president of Internet Service Provider of Bangladesh (ISPAB) said, I automatically got back my WhatsApp account. What...
Read More
ISPAB president “whatsapp” got hacked via phishing link

Zyxel released patches 2 vulns in its USG FLEX H series firewalls

Zyxel Networks has issued critical security patches for two high-severity vulnerabilities in its USG FLEX H series firewalls. These flaws...
Read More
Zyxel released patches 2 vulns in its USG FLEX H series firewalls

South Korea’s largest SK Telecom Hit by Malware: SIM-related info leaked

South Korea's largest mobile operator, SK Telecom, is warning that a malware infection allowed threat actors to access sensitive USIM-related...
Read More
South Korea’s largest SK Telecom Hit by Malware: SIM-related info leaked

ChatGPT Develops Exploit for CVEs Before Public PoCs Share

Security researcher Matt Keeley showed that artificial intelligence can now develop working exploits for critical vulnerabilities before public proof-of-concept (PoC)...
Read More
ChatGPT Develops Exploit for CVEs Before Public PoCs Share

TP-Link Router Vulns Allow to Execute Malicious SQL Commands

Several vulnerabilities have been found in TP-Link routers, exposing users to serious security risks from SQL injection flaws in their...
Read More
TP-Link Router Vulns Allow to Execute Malicious SQL Commands

SSL.com’s domain validation system’s bug found: Hacker exploited

SSL.com has revealed a major security flaw in its domain validation system, which could enable attackers to acquire fake SSL...
Read More
SSL.com’s domain validation system’s bug found: Hacker exploited

Amazon Follows Microsoft’s Lead, Halts Some Data Center Deals

Amazon has paused some data center lease negotiations for its cloud division, particularly in international markets, according to Wells Fargo...
Read More
Amazon Follows Microsoft’s Lead, Halts Some Data Center Deals

Hackers Exploit Zoom’s Remote Control Feature for System Access

ELUSIVE COMET is a threat actor conducting a sophisticated attack campaign that uses Zoom's remote control feature to access victims'...
Read More
Hackers Exploit Zoom’s Remote Control Feature for System Access

The phishing campaign is done by a group called ‘Sidewinder’. This group has been operating since 2012 and is known for targeting government, military, and business entities in countries like Pakistan, China, Nepal, and more in Asia. They mainly use spear phishing attacks to gain unauthorized access to their targets.

Threat motives:
Sensitive, Confidential and Classified information theft and cyber espionage.

Target Sectors:
Government, Military, Law enforcement, HealthCare, Telecommunication, Financial Institutions, News and Media

Source: BGD e-GOV CIRT

Target Countries:
Afghanistan, Armenia, China, Bangladesh, Belarus, Bhutan, Brazil, China, India, Israel, Kazakhstan, Kyrgyzstan, Mexico, Moldova, Myanmar, Nepal, Pakistan, Philippines, Poland, Qatar, Russian Federation, Saudi Arabia, Singapore, Sri Lanka, Tajikistan, Thailand, Turkey, Turkmenistan, Ukraine, Uzbekistan

SideWinder’s Cyberattack Chain:
“CIRT identified the attack process executed by the threat actor in various stages.”

Source: BGD e-GOV CIRT

Initial access vector:
SideWinder uses spear phishing to target their victims. The attack starts with the victim receiving a fake email containing a harmful attachment or URL. The emails are made to look like they are from organizations the victims are affiliated with and appear to be related to their interests. They used domain names resembling those of government, military, and law enforcement agencies in Bangladesh. For example, cirt-gov-bd.donwloaded[.]com.

Code execution:
* When a user clicks on the malicious link/attached file (RTF, DOCX, ZIP, LNK,..etc.), a code execution is initiated to download a remote HTA file from the group’s controlled server.

* The HTA file run leads to the execution of the payload malware through DLL side
loading technique. (The malware can be a remote access Trojan (RAT) or an
information stealer)

* The Malware starts collecting sensitive and confidential info./files and send it to the
C2 server.

Phishing Domains:
BGD e-GOV CIRT’s Cyber Threat Intelligence Unit has found several phishing domains that imitate official websites and domains in Bangladesh. These domains are being used in an ongoing phishing campaign against entities in the country. The investigation has revealed that the domains, hash files, and IP addresses are associated with the SideWinder APT group. This group specifically targets government and law enforcement organizations in Bangladesh. Here are some of the phishing domains that have been identified:

Source: BGD e-GOV CIRT

To prevent malware execution following phishing attacks CIRT indicate some ways to be followed. Using denylists to block known malicious domains, URLs, and IP addresses as well as file extensions such as .scr, .exe, .pif, and .cpl and mislabeled file extensions (e.g., a .exe file that is labeled as a .doc file. Users must be restricted having adminstrative rights of MacOS and Windows. CIRT urges to implement the principle of least privilege (PoLP) when administering user accounts and to block macros by default.

Check Also

ransomware

Bengaluru firm got ransomware attack, Hacker demanded $70,000

Bengaluru’s Whiteboard Technologies Pvt Ltd was hit by a ransomware attack, with hackers demanding a …

Leave a Reply

Your email address will not be published. Required fields are marked *