Security News > 2023 > May > State-Sponsored Sidewinder Hacker Group's Covert Attack Infrastructure Uncovered
Cybersecurity researchers have unearthed previously undocumented attack infrastructure used by the prolific state-sponsored group SideWinder to strike entities located in Pakistan and China.
SideWinder has been known to be active since at least 2012, with attack chains primarily leveraging spear-phishing as an intrusion mechanism to obtain a foothold into targeted environments.
More recently, the nation-state group was observed leveraging a technique known as server-based polymorphism in evasive attacks targeting Pakistani government organizations.
Another LNK file that was uploaded to VirusTotal around the same time from Kathmandu employs a similar method to fetch an HTA file from a domain masquerading as a Nepalese government website.
Further investigation into SideWinder's infrastructure has led to the discovery of a malicious Android APK file that was uploaded to VirusTotal from Sri Lanka in March 2023.
In all, the domains point to SideWinder setting its sights on financial, government, and law enforcement organizations, as well as companies specializing in e-commerce and mass media in Pakistan and China.
News URL
https://thehackernews.com/2023/05/state-sponsored-sidewinder-hacker.html
Related news
- Cyber attacks on critical infrastructure show advanced tactics and new capabilities (source)
- Microsoft still unsure how hackers stole MSA key in 2023 Exchange attack (source)
- Apple stops warning of 'state-sponsored' attacks, now alerts about 'mercenary spyware' (source)
- Hackers Deploy Python Backdoor in Palo Alto Zero-Day Attack (source)
- TA558 Hackers Weaponize Images for Wide-Scale Malware Attacks (source)
- Hackers hijack OpenMetadata apps in Kubernetes cryptomining attacks (source)
- State-Sponsored Hackers Exploit Two Cisco Zero-Day Vulnerabilities for Espionage (source)
- REvil hacker behind Kaseya ransomware attack gets 13 years in prison (source)
- Kimsuky hackers deploy new Linux backdoor in attacks on South Korea (source)
- Iranian MOIS-Linked Hackers Behind Destructive Attacks on Albania and Israel (source)