Rewterz Threat Alert – APT SideWinder Group Targeting Pakistan – Active IOCs

Severity

High

Analysis Summary

The SideWinder APT (Advanced Persistent Threat) Group is a sophisticated cyber espionage group that has been active since at least 2012. The group is believed to be based in India and has targeted government agencies, military organizations, and financial institutions in South Asia and the Middle East.

The SideWinder APT group is known for using a range of sophisticated tactics and techniques to carry out its attacks. These include social engineering, spear-phishing, and the use of zero-day exploits to infiltrate target networks. Once inside a target network, the group uses custom malware and backdoors to gain persistent access and steal sensitive data. It appears that they are now targeting Pakistan with a malicious file named “DMP (Navy) Visit.docx”

It is likely that this file is being distributed via email or other means of communication in an attempt to trick victims into opening it. Once the file is opened, it may execute malicious code that could compromise the victim’s computer or network.

Impact

• Information Theft and Espionage

Indicators of Compromise

Domain Name

• govpk.org
• paknavy.comsats.xyz
• paknavy.jmicc.xyz
• paknavy.paknavy.live
• paknavy-gov-pkp.downld.net
• paknavy-gov-pk.downld.net
• mofa-gov.interior-pk.org
• ministryofforeignaffairs-mofa-gov-pk.dytt88.org

MD5

• 6af17fdbf7974c1a9a08a38b755d363b
• d46901f096683bd2e9c2c290a821d0cd

SHA-256

• a703c6772e8bcf7cd0aef05ecbee4c7f7f39371d45b42bf1030df2be5261717c
• 46eae74e90b325bb29fb92810c453a700d705730a0c8e04738b7d52d68fa00ea

SHA-1

• 230911dbeaab0631c9df32fdfd8b726977866fd9
• b465e0e94a15f76eac92546e84acb6f3b10111e5

URL

https://mail-dmp-navy-pk.dytt88.org/14459/1/23/2/0/0/0/m/files-14333226/file.rtf

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Maintain cyber hygiene by updating your anti-virus software and implementing a patch management lifecycle.
• Maintain Offline Backups – In a ransomware attack, the adversary will often delete or encrypt backups if they have access to them. That’s why it’s important to keep offline (preferably off-site), encrypted backups of data and test them regularly.
• Emails from unknown senders should always be treated with caution.
• Never trust or open links and attachments received from unknown sources/senders.