Unmasking Sidewinder’s Latest Attack Wave

SideWinder, a persistent Advanced Persistent Threat (APT) group, has intensified its cyber-espionage operations, expanding its focus to maritime infrastructure, logistics companies, and the nuclear energy sector. In its latest attack wave, the group continues to refine its toolset, demonstrating rapid malware adaptation and advanced evasion techniques.

With highly adaptive tactics, frequent code modifications, and a rapid malware update cycle (under 5 hours to evade detections), SideWinder remains a formidable cyber threat to critical infrastructure worldwide.

Severity Level: High

Threat Details

1. Attack Methodology:

• Spear-phishing emails contain a malicious DOCX attachment that exploits remote template injection.
• The document downloads an RTF file from an attacker-controlled server, which exploits CVE-2017-11882 to execute malicious shellcode.
• The attack leads to the deployment of a multi-stage infection process, installing the Backdoor Loader malware.
• This loader executes StealerBot, a private post-exploitation toolkit, which allows for data exfiltration and persistent access.

2. Key Malware Components:

• Backdoor Loader: Primary malware designed to load StealerBot into memory.
• StealerBot: Advanced implant used for espionage, credential theft, and persistence.
• Downloader Module: A .NET-based malware that collects information about installed security software and deploys additional payloads.

3. Infrastructure & Evasion Techniques:

• SideWinder maintains a large and dynamic C2 infrastructure, frequently rotating domains and IP addresses.
• They rapidly modify malware signatures to bypass security detections, sometimes within hours of exposure.
• Recent campaigns show enhanced anti-analysis techniques, including Control Flow Flattening to obscure code execution.
• Heavy use of legitimate Windows utilities (mshta.exe) for stealthy execution of malware.

4. Victimology:

• Affected Regions: Egypt, Djibouti, United Arab Emirates, Bangladesh, Cambodia, Vietnam, Algeria, Saudi Arabia, Uganda, Rwanda, Turkey, Bulgaria, China, Afghanistan, India, Maldives, Austria, Mozambique, Pakistan, Sri Lanka, Nepal, Myanmar, Indonesia, and Philippines.
• Affected Sectors: Maritime, logistics, nuclear energy, telecommunication, consulting, IT service companies, real estate agencies, hotels, government, military, and diplomatic entities.

Recommendations

1. Apply the latest Microsoft Office security patches, especially for CVE-2017-11882, which SideWinder exploits.
2. Disable Office macros and OLE object execution from untrusted sources.
3. Implement Microsoft Office Protected View for files downloaded from email or the internet.
4. Educate employees to identify and report spear-phishing attempts.
5. Train users to verify email senders before opening attachments.
6. Avoid sharing sensitive information via email without encryption.
7. Block execution of mshta.exe, wscript.exe, and other LOLBins (Living Off The Land Binaries) from unexpected locations often abused by malware.
8. Use Windows Defender Application Control (WDAC) or AppLocker to prevent unauthorized software execution.
9. Block the IOCs at their respective controls.

Source:

• https://www.virustotal.com/gui/collection/6afb7c6886836c5559979e06aec097b08b9c9596dcf42c4c650c5d61897912d1/iocs
• https://securelist.com/sidewinder-apt-updates-its-toolset-and-targets-nuclear-sector/115847/

Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn.