• Home
  • Cyber Crime
  • Cyber warfare
  • APT
  • Data Breach
  • Deep Web
  • Digital ID
  • Hacking
  • Hacktivism
  • Intelligence
  • Internet of Things
  • Laws and regulations
  • Malware
  • Mobile
  • Reports
  • Security
  • Social Networks
  • Terrorism
  • ICS-SCADA
  • POLICIES
  • Contact me
MUST READ

Cisco fixed maximum-severity security flaw in Secure Firewall Management Center

 | 

'Blue Locker' Ransomware Targeting Oil & Gas Sector in Pakistan

 | 

Hackers exploit Microsoft flaw to breach Canada ’s House of Commons

 | 

Norway confirms dam intrusion by Pro-Russian hackers

 | 

Zoom patches critical Windows flaw allowing privilege escalation

 | 

Manpower data breach impacted 144,180 individuals

 | 

U.S. CISA adds Microsoft Internet Explorer, Microsoft Office Excel, and WinRAR flaws to its Known Exploited Vulnerabilities catalog

 | 

Critical FortiSIEM flaw under active exploitation, Fortinet warns

 | 

Charon Ransomware targets Middle East with APT attack methods

 | 

Hackers leak 2.8M sensitive records from Allianz Life in Salesforce data breach

 | 

SAP fixed 26 flaws in August 2025 Update, including 4 Critical

 | 

August 2025 Patch Tuesday fixes a Windows Kerberos Zero-Day

 | 

Dutch NCSC: Citrix NetScaler zero-day breaches critical orgs

 | 

Chrome sandbox escape nets security researcher $250,000 reward

 | 

Smart Buses flaws expose vehicles to tracking, control, and spying

 | 

MedusaLocker ransomware group is looking for pentesters

 | 

Google confirms Salesforce CRM breach, faces extortion threat

 | 

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 57

 | 

Security Affairs newsletter Round 536 by Pierluigi Paganini – INTERNATIONAL EDITION

 | 

Embargo Ransomware nets $34.2M in crypto since April 2024

 | 
  • Home
  • Cyber Crime
  • Cyber warfare
  • APT
  • Data Breach
  • Deep Web
  • Digital ID
  • Hacking
  • Hacktivism
  • Intelligence
  • Internet of Things
  • Laws and regulations
  • Malware
  • Mobile
  • Reports
  • Security
  • Social Networks
  • Terrorism
  • ICS-SCADA
  • POLICIES
  • Contact me
  • Home
  • Breaking News
  • Cyber warfare
  • Hacking
  • Intelligence
  • SideWinder phishing campaign targets maritime facilities in multiple countries

SideWinder phishing campaign targets maritime facilities in multiple countries

Pierluigi Paganini July 30, 2024

The APT group SideWinder launched a new espionage campaign targeting ports and maritime facilities in the Indian Ocean and Mediterranean Sea.

SideWinder (also known as Razor Tiger, Rattlesnake, and T-APT-04) has been active since at least 2012, the group mainly targeted Police, Military, Maritime, and the Naval forces of Central Asian countries. In the 2022 attacks, the threat actors also targeted departments of Foreign Affairs, Scientific and Defence organisations, Aviation, IT industry, and Legal firms.

The threat actor maintains a large C2 infrastructure composed of more than 400 domains and subdomains that were used to host malicious payloads and control them.

The BlackBerry Research and Intelligence Team attributed the campaign to the SideWinder group.

The domains and documents employed in the campaign as part of the first stage of the attack suggest threat actors are targeting of Pakistan, Egypt and Sri Lanka. Subdomains used with the second stage delivery demonstrate that the attackers are also targeting of Bangladesh, Myanmar, Nepal and the Maldives.

In recent campaign, the threat actors used meticulously crafted documents that appear to be legitimate and familiar to the target. The bait documented feature recognizable logos and themes relevant to the victim’s work environment. These documents serve as “visual bait” and often relate to specific infrastructure, such as ports. In one case, attackers users documents falsely associated with the Port of Alexandria and the Port Authority of the Red Sea. The experts identified three different visual decoys with title like “employee termination” and “salary cut.” The attackers use these decoy documents as a diversive tactic while while the malware is being deployed.

“Threat actors hope that by eliciting strong emotions such as fear or anxiety, the target will be compelled to immediately open and read the document. The victim will then be so distracted that they won’t notice strange events on their device such as (for example) system popups or increased fan noise caused by high CPU utilization, which is often an early warning sign of a malware infection in progress.” reads the analysis published by the BlackBerry researchers.

SideWinder phishing campaign

Upon opening the decoy file, it relies on a remote template injection technique (CVE-2017-0199) to gain initial access to the target’s system. This vulnerability impacts Microsoft Office and allowed attackers to use a specially-crafted document embedding an OLE2link object to spread malware.

“While labelled as an Outlook issue, this is actually bug actually stems from an issue within RTF files. According to published reports, the exploit uses an embedded OLE2link object in a specially-crafted document. It should also be noted that these attacks can be thwarted by enabling Office’s Protective View feature. There are updates for both Office and Windows to be applied, and both should be considered necessary for complete protection.” reads the Patch Tuesday analysis by the Zero Day Initiative.

Despite the flaw was addressed by Microsoft in April 2017, attackers are exploiting the vulnerability by targeting large organizations with outdated, fragmented, or antiquated infrastructures. They attempt to target endpoints within these organizations that remained unpatched, thus vulnerable to attack.

The phishing emails include a malicious document which contains a plain text URL linking to a site controlled by the attacker. When the document is opened, it accesses this URL to download the next stage of the malware. Specifically, an RTF file exploits the CVE-2017-11882 vulnerability to execute shellcode, which checks whether the system is a real machine (not a virtual machine) before decrypting the malicious code and runbing JavaScript code that loads additional malicious payloads from a remote server. This method helps evade detection by security teams.

The report includes Indicators of Compromise (IoCs) for this campaign along with a detailed MITRE ATT&CK® Mapping, however the researchers have yet to yet observe any samples of the JavaScript delivered in the last stage of the attack.

“The SideWinder threat actor continues to improve its infrastructure for targeting victims in new regions. The steady evolution of its network infrastructure and delivery payloads suggests that SideWinder will continue its attacks in the foreseeable future.” concludes the report. “However, based on SideWinder’s prior campaigns, we believe that the goal of this campaign is espionage and intelligence gathering.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, phishing)


facebook linkedin twitter

hacking news information security news IT Information Security phishing Pierluigi Paganini Security Affairs Security News SideWinder

you might also like

Pierluigi Paganini August 15, 2025
Cisco fixed maximum-severity security flaw in Secure Firewall Management Center
Read more
Pierluigi Paganini August 15, 2025
'Blue Locker' Ransomware Targeting Oil & Gas Sector in Pakistan
Read more

leave a comment

newsletter

Subscribe to my email list and stay
up-to-date!

    recent articles

    Cisco fixed maximum-severity security flaw in Secure Firewall Management Center

    Security / August 15, 2025

    'Blue Locker' Ransomware Targeting Oil & Gas Sector in Pakistan

    Malware / August 15, 2025

    Hackers exploit Microsoft flaw to breach Canada ’s House of Commons

    Hacking / August 15, 2025

    Norway confirms dam intrusion by Pro-Russian hackers

    Hacktivism / August 14, 2025

    Zoom patches critical Windows flaw allowing privilege escalation

    Security / August 14, 2025

    To contact me write an email to:

    Pierluigi Paganini :
    pierluigi.paganini@securityaffairs.co

    LEARN MORE

    QUICK LINKS

    • Home
    • Cyber Crime
    • Cyber warfare
    • APT
    • Data Breach
    • Deep Web
    • Digital ID
    • Hacking
    • Hacktivism
    • Intelligence
    • Internet of Things
    • Laws and regulations
    • Malware
    • Mobile
    • Reports
    • Security
    • Social Networks
    • Terrorism
    • ICS-SCADA
    • POLICIES
    • Contact me

    Copyright@securityaffairs 2024

    We use cookies on our website to give you the most relevant experience by remembering your preferences and repeat visits. By clicking “Accept All”, you consent to the use of ALL the cookies. However, you may visit "Cookie Settings" to provide a controlled consent.
    Cookie SettingsAccept All
    Manage consent

    Privacy Overview

    This website uses cookies to improve your experience while you navigate through the website. Out of these cookies, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities...
    Necessary
    Always Enabled
    Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
    Non-necessary
    Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.
    SAVE & ACCEPT