Tuesday , April 1 2025
BGD eGOV CIRT

BD CIRT REPORT
Ongoing Phishing Campaign targeting Bangladesh by APT group SideWinder

Cyber Threat Intelligence Unit of BGD e-GOV CIRT has detected a suspicious ongoing phishing campaign by APT group named as SideWinder targeted at Bangladeshi entities such as Bangladesh Armed Forces Division (AFD) and Law Enforcement Agencies.

The group is known as a highly active hacker group who has shown the capability to conductseveral attacks within a short time span and poses threats to organizations in South and East Asia. This alert includes an extensive list of IOCs and the group TTPs in order to help Bangladeshi organizations in taking preventive security measures accordingly. In Primary investigation we noticed that the main target of this APT group is to steal sensitive, confidential and classified documents.

CVE-2025-1268
Patch urgently! Canon Fixes Critical Printer Driver Flaw

Canon has announced a critical security vulnerability, CVE-2025-1268, in printer drivers for its production printers, multifunction printers, and laser printers....
Read More
CVE-2025-1268  Patch urgently! Canon Fixes Critical Printer Driver Flaw

Within Minute, RamiGPT To Escalate Privilege Gaining Root Access

RamiGPT is an AI security tool that targets root accounts. Using PwnTools and OpwnAI, it quickly navigated privilege escalation scenarios...
Read More
Within Minute, RamiGPT To Escalate Privilege Gaining Root Access

Australian fintech database exposed in 27000 records

Cybersecurity researcher Jeremiah Fowler recently revealed a sensitive data exposure involving the Australian fintech company Vroom by YouX, previously known...
Read More
Australian fintech database exposed in 27000 records

Over 200 Million Info Leaked Online Allegedly Belonging to X

Safety Detectives' Cybersecurity Team found a forum post where a threat actor shared a .CSV file with over 200 million...
Read More
Over 200 Million Info Leaked Online Allegedly Belonging to X

FBI investigating cyberattack at Oracle, Bloomberg News reports

The Federal Bureau of Investigation (FBI) is probing the cyberattack at Oracle (ORCL.N), opens new tab that has led to...
Read More
FBI investigating cyberattack at Oracle, Bloomberg News reports

OpenAI Offering $100K Bounties for Critical Vulns

OpenAI has increased its maximum bug bounty payout to $100,000, up from $20,000, to encourage the discovery of critical vulnerabilities...
Read More
OpenAI Offering $100K Bounties for Critical Vulns

Splunk Alert User RCE and Data Leak Vulns

Splunk has released a security advisory about critical vulnerabilities in Splunk Enterprise and Splunk Cloud Platform. These issues could lead...
Read More
Splunk Alert User RCE and Data Leak Vulns

CIRT alert Situational Awareness for Eid Holidays

As the Eid holidays near, cybercriminals may try to take advantage of weakened security during this time. The CTI unit...
Read More
CIRT alert Situational Awareness for Eid Holidays

Cyberattack on Malaysian airports: PM rejected $10 million ransom

Operations at Kuala Lumpur International Airport (KLIA) were unaffected by a cyber attack in which hackers demanded US$10 million (S$13.4...
Read More
Cyberattack on Malaysian airports: PM rejected $10 million ransom

Micropatches released for Windows zero-day leaking NTLM hashes

Unofficial patches are available for a new Windows zero-day vulnerability that allows remote attackers to steal NTLM credentials by deceiving...
Read More
Micropatches released for Windows zero-day leaking NTLM hashes

The phishing campaign is done by a group called ‘Sidewinder’. This group has been operating since 2012 and is known for targeting government, military, and business entities in countries like Pakistan, China, Nepal, and more in Asia. They mainly use spear phishing attacks to gain unauthorized access to their targets.

Threat motives:
Sensitive, Confidential and Classified information theft and cyber espionage.

Target Sectors:
Government, Military, Law enforcement, HealthCare, Telecommunication, Financial Institutions, News and Media

Source: BGD e-GOV CIRT

Target Countries:
Afghanistan, Armenia, China, Bangladesh, Belarus, Bhutan, Brazil, China, India, Israel, Kazakhstan, Kyrgyzstan, Mexico, Moldova, Myanmar, Nepal, Pakistan, Philippines, Poland, Qatar, Russian Federation, Saudi Arabia, Singapore, Sri Lanka, Tajikistan, Thailand, Turkey, Turkmenistan, Ukraine, Uzbekistan

SideWinder’s Cyberattack Chain:
“CIRT identified the attack process executed by the threat actor in various stages.”

Source: BGD e-GOV CIRT

Initial access vector:
SideWinder uses spear phishing to target their victims. The attack starts with the victim receiving a fake email containing a harmful attachment or URL. The emails are made to look like they are from organizations the victims are affiliated with and appear to be related to their interests. They used domain names resembling those of government, military, and law enforcement agencies in Bangladesh. For example, cirt-gov-bd.donwloaded[.]com.

Code execution:
* When a user clicks on the malicious link/attached file (RTF, DOCX, ZIP, LNK,..etc.), a code execution is initiated to download a remote HTA file from the group’s controlled server.

* The HTA file run leads to the execution of the payload malware through DLL side
loading technique. (The malware can be a remote access Trojan (RAT) or an
information stealer)

* The Malware starts collecting sensitive and confidential info./files and send it to the
C2 server.

Phishing Domains:
BGD e-GOV CIRT’s Cyber Threat Intelligence Unit has found several phishing domains that imitate official websites and domains in Bangladesh. These domains are being used in an ongoing phishing campaign against entities in the country. The investigation has revealed that the domains, hash files, and IP addresses are associated with the SideWinder APT group. This group specifically targets government and law enforcement organizations in Bangladesh. Here are some of the phishing domains that have been identified:

Source: BGD e-GOV CIRT

To prevent malware execution following phishing attacks CIRT indicate some ways to be followed. Using denylists to block known malicious domains, URLs, and IP addresses as well as file extensions such as .scr, .exe, .pif, and .cpl and mislabeled file extensions (e.g., a .exe file that is labeled as a .doc file. Users must be restricted having adminstrative rights of MacOS and Windows. CIRT urges to implement the principle of least privilege (PoLP) when administering user accounts and to block macros by default.

Check Also

CheckPoint

Cybercriminals Exploit Checkpoint’s Driver in a BYOVD Attack

Threat actors are exploiting a component of CheckPoint’s ZoneAlarm antivirus to bypass Windows security measures. …

Leave a Reply

Your email address will not be published. Required fields are marked *