SideWinder Adopts New ClickOnce-Based Attack Chain Targeting South Asian Diplomats
In September 2025, a threat actor identified as SideWinder launched a fresh assault against a European embassy in the Indian capital of fresh Delhi, as well as several organizations in Bangladesh, Pakistan, and Sri Lanka.
In a report released last week, Trellix researchers Ernesto Fernández Provecho and Pham Duy Phuc noted that the activity shows a significant evolution in SideWinder's TTPs, specifically the adoption of a novel PDF and ClickOnce-based infection chain in addition to their previously known Microsoft Word exploit vectors.
From March to September 2025, four waves of spear-phishing emails were sent. The attacks' goal was to collect sensitive data from vulnerable hosts by dropping malware families including ModuleInstaller and StealerBot.
StealerBot is a.NET implant th...