The SideWinder advanced persistent threat group has emerged with a sophisticated new attack methodology that leverages ClickOnce applications to deploy StealerBot malware against diplomatic and governmental targets across South Asia.

In September 2025, security researchers detected a targeted campaign affecting institutions in Sri Lanka, Pakistan, Bangladesh, and diplomatic missions based in India.

The attacks represent a notable evolution in the threat actor’s tradecraft, moving beyond traditional Microsoft Word-based exploits to embrace a more complex PDF and ClickOnce infection chain designed to circumvent modern security controls.

The campaign unfolded through multiple waves of spear-phishing emails, each carefully crafted with region-specific themes to manipulate victims into executing malicious payloads.

Attack lures included documents titled “Inter-ministerial meeting Credentials.pdf” and “Relieving order New Delhi.pdf,” which prompted targets to download what appeared to be an updated version of Adobe Reader.

When victims clicked the embedded button, they unknowingly initiated a ClickOnce application download from attacker-controlled infrastructure.

These applications bore valid digital signatures from MagTek Inc., not through certificate theft but via DLL side-loading of legitimate MagTek binaries—a technique that allowed the malware to bypass Windows security warnings and execute without raising immediate suspicion.

Trellix analysts identified the malware’s sophisticated evasion mechanisms after detecting the fourth wave of attacks through their SecondSight hunting capabilities on Trellix Email Security.

The researchers noted that SideWinder implemented advanced operational security measures including geofencing, which restricted payload delivery to IP addresses originating from targeted regions.

This geographic restriction prevented security researchers outside South Asia from accessing live malware samples, significantly complicating analysis efforts.

Additionally, the threat actors employed dynamically generated URLs with random numeric components and time-limited payload availability, ensuring that malicious components remained accessible only during narrow windows immediately following initial compromise.

The technical sophistication extends to the malware’s persistence and execution mechanisms.

Once the ClickOnce application executes, it drops DEVOBJ.dll alongside an encrypted payload file with randomized extensions such as .ns5 or .1ym.

The DLL performs XOR decryption using the first 42 bytes of the encrypted file as the key, revealing a .NET loader (App.dll) that downloads ModuleInstaller from the command-and-control server.

ModuleInstaller then profiles the compromised system and retrieves configuration files, including TapiUnattend.exe—a legitimate Windows binary—and wdscore.dll, which side-loads to execute the final-stage StealerBot malware.

The malware demonstrates adaptive behavior by detecting installed antivirus products and adjusting its execution path accordingly, using mshta.exe for Avast or AVG detections and pcalua.exe when Kaspersky is present.

ClickOnce Application Structure and DLL Side-Loading

The infection chain’s core strength lies in its abuse of ClickOnce’s trusted application deployment framework.

SideWinder weaponized legitimate MagTek Reader Configuration application (version 1.5.13.2) by preserving its structural integrity while replacing critical components.

The attackers substituted the authentic MagTek public key token (7ee65bc326f1c13a) with null values (0000000000000000) in the manifest, maintaining valid certificate chains to evade detection.

The application’s branding was modified from MagTek to “Adobe Compatibility Suite,” complete with an Adobe Reader icon replacement, perfectly aligning with the phishing lure’s premise.

<!-- Malicious ClickOnce Manifest Excerpt -->
<dependency>
  <dependentAssembly>
    <assemblyIdentity name="ReaderConfiguration" 
                      version="1.5.13.2" 
                      publicKeyToken="0000000000000000" />
  </dependentAssembly>
</dependency>

The payload delivery mechanism substituted legitimate JSON configuration files (DeviceImages.json and EmvVendorConfig.json) with malicious DEVOBJ.dll (SHA256: c1093860c1e5e04412d8509ce90568713fc56a0d5993bfdb7386d8dc5e2487b6).

This DLL serves as the side-loading vector for subsequent stages. The manifest included useLegacyV2RuntimeActivationPolicy=”true” to enable compatibility with older .NET Framework versions, facilitating execution of legacy malware components.

After execution, a decoy PDF document displays to victims, maintaining the illusion of legitimate document processing while malware establishes persistence and begins data exfiltration operations in the background.

The StealerBot malware represents the campaign’s ultimate objective, designed for comprehensive espionage operations.

While researchers successfully identified the core infection chain components, geofencing restrictions prevented the acquisition of additional plugin modules beyond IPHelper.dll, which manages proxy communications within the malware ecosystem.

The campaign’s infrastructure—spanning domains like mofa-gov-bd[.]filenest[.]live and mod-gov-bd[.]snagdrive[.]com—demonstrates deliberate impersonation of government ministries to enhance social engineering effectiveness.

This combination of technical sophistication and operational security reflects an adversary committed to long-term espionage objectives against strategic regional targets.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post SideWinder Hacking Group Uses ClickOnce-Based Infection Chain to Deploy StealerBot Malware appeared first on Cyber Security News.

The Advanced Persistent Threat group MuddyWater, widely recognized as an Iran-linked espionage actor, has orchestrated a sophisticated phishing campaign targeting more than 100 government entities and international organizations across the Middle East, North Africa, and beyond.

The operation, which became active in mid-August 2025, represents a significant escalation in the group’s tradecraft, introducing version 4 of the Phoenix backdoor malware alongside newly developed tools designed to evade traditional security defenses.

The campaign gained momentum through a deceptively simple yet effective technique: a compromised mailbox accessed via NordVPN.

MuddyWater leveraged this access point to send phishing emails to high-value targets, impersonating legitimate correspondence from trusted organizations.

The emails contained Microsoft Word attachments that appeared innocuous, prompting recipients to “enable content” to view the document.

This social engineering approach exploited the inherent trust users place in familiar communication channels, significantly increasing the likelihood of successful infections.

Once recipients enabled macros within the Word documents, malicious Visual Basic for Application code executed on their systems, initiating a multi-stage attack chain.

The embedded macros functioned as a dropper, retrieving and executing the FakeUpdate loader—an injector-style component that decrypts and injects encrypted payloads directly into its own process memory, bypassing traditional file-based detection mechanisms.

Group-IB analysts identified the second-stage payload as Phoenix backdoor version 4, a custom malware exclusively tied to MuddyWater operations.

This latest iteration demonstrates technological refinement, employing registry-based persistence through modifications to the Winlogon shell value while simultaneously creating mutex objects for coordination.

The backdoor registers infected hosts with attacker command-and-control infrastructure, establishing continuous beaconing relationships that enable remote command execution, data exfiltration, and post-exploitation activities.

Technical Evolution and Persistence Mechanisms

The Phoenix v4 variant introduces sophisticated persistence tactics beyond traditional registry manipulation.

Analysis revealed embedded Component Object Model Dynamic Link Library artifacts designed to launch additional malware, such as Mononoke.exe, through alternative execution pathways.

The malware systematically gathers comprehensive system information—computer names, domain configurations, Windows versions, and user credentials—before initiating communication with C2 servers via WinHTTP protocols.

Command mappings indicate support for file uploads, shell execution, and sleep interval modifications, providing attackers granular control over compromised systems.

Infrastructure investigation uncovered the hardcoded C2 domain screenai[.]online, registered on August 17, 2025, and operational for approximately five days.

The real server address, 159.198.36.115, hosted additional tools including a custom Chromium browser credential stealer and legitimate Remote Monitoring and Management utilities like PDQ and Action1.

The credential stealer specifically targets stored passwords from Chrome, Opera, Brave, and Microsoft Edge by extracting encrypted master keys and writing harvested credentials to staging files for exfiltration.

MuddyWater’s deployment of this integrated toolkit—combining custom malware with legitimate RMM solutions—demonstrates sophisticated understanding of operational security and persistence mechanisms, underscoring the group’s commitment to long-term espionage objectives rather than opportunistic campaigns.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post MuddyWater Using New Malware Toolkit to Deliver Phoenix Backdoor Malware to International Organizations appeared first on Cyber Security News.