{
  "name": "Operation SouthNet: SideWinder Expands Phishing and Malware Operations in South Asia",
  "slug": "operation-southnet-sidewinder-expands-phishing-and-malware-operations-in-south-asia",
  "description": "APT SideWinder has launched a new targeted operation dubbed Operation SouthNet, focusing on the maritime sector in South Asia, particularly Pakistan and Sri Lanka. The group leverages free hosting platforms to deploy credential-harvesting portals and weaponized lure documents, while staging malware in open directories. Over 50 malicious domains were uncovered across various platforms, with Pakistan accounting for 40% of the identified domains. The campaign utilizes maritime and port-themed lures to target government and military entities. SideWinder's infrastructure overlaps with legacy C2 assets, indicating recycling across multiple years. The group maintains a high operational tempo, with new phishing domains emerging every 3-5 days.",
  "published": "2025-10-06T06:11:00+00:00",
  "created_at": "2025-10-06T06:11:00+00:00",
  "modified_at": "2025-10-06T09:03:47+00:00",
  "created_at_opencti": "2025-10-06T06:11:00+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-10-06",
    "apt",
    "credential harvesting",
    "government",
    "military",
    "phishing",
    "south asia"
  ],
  "related_entities": {
    "malware": [
      {
        "id": "78ecff86-e5a6-4ec4-80a4-e9a86939e860",
        "name": "agent2.malz",
        "slug": "agent2malz"
      },
      {
        "id": "f12a0342-39fb-44db-b1aa-82e20badedfd",
        "name": "gwadardxgi.dll",
        "slug": "gwadardxgidll"
      },
      {
        "id": "7664f3ef-ab06-4653-b5e5-464716f9dc15",
        "name": "EdgUpdate.exe",
        "slug": "edgupdateexe"
      },
      {
        "id": "fd7a11ea-8b73-4fd8-a1c4-91ae2ca875de",
        "name": "AdobeUpdateCore.exe",
        "slug": "adobeupdatecoreexe"
      }
    ],
    "intrusion_sets": [
      {
        "id": "30cbcbf2-21bc-489d-8705-845e05a87de5",
        "name": "Sidewinder",
        "slug": "sidewinder"
      }
    ],
    "attack_patterns": [
      {
        "id": "146a6f45-ec55-4d0e-a38c-1b614c3f72d2",
        "name": "T1193"
      },
      {
        "id": "c9de6d3f-08cf-448d-8b9f-9aeff59fc48f",
        "name": "T1550"
      },
      {
        "id": "1e73eaa9-ea78-444b-b3a3-5842f5d35115",
        "name": "T1074"
      },
      {
        "id": "fe6f2946-a01e-460c-9636-8c48b45dd0e6",
        "name": "T1189"
      },
      {
        "id": "97d377d8-89c7-48f8-a79f-0f48bd60df74",
        "name": "T1005"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "dc342445-1b78-48b4-aa06-89ed2ad7c28e",
        "name": "T1071"
      },
      {
        "id": "804630c7-dda3-49df-9ac4-70bd1ad83e06",
        "name": "T1192"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "50514c04-b3a2-4abf-a855-e3a434200c87",
        "name": "T1204"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "81ee4813-4f68-4984-bec1-980d7c5b56eb",
        "name": "T1132"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "6aa7866f-9c1f-4159-938a-10a6adf41646",
        "name": "T1553"
      },
      {
        "id": "0b2b1ecd-d52e-492a-af08-050954bc03e5",
        "name": "T1056"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "6c8f8a40-2746-4a37-86bd-81e82afa6e62",
        "name": "T1190"
      },
      {
        "id": "b9eab970-53dd-4977-9a26-c4fe566e422d",
        "name": "T1133"
      },
      {
        "id": "9f11a241-9abc-4c57-95dd-33955ab08826",
        "name": "T1078"
      },
      {
        "id": "74d6e294-54d1-4a21-9dfc-df5870f8ec8e",
        "name": "T1003"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Myanmar"
      },
      {
        "id": "",
        "name": "Singapore"
      },
      {
        "id": "",
        "name": "Sri Lanka"
      },
      {
        "id": "",
        "name": "Nepal"
      },
      {
        "id": "",
        "name": "Bangladesh"
      },
      {
        "id": "",
        "name": "Pakistan"
      },
      {
        "id": "",
        "name": "Defense"
      },
      {
        "id": "",
        "name": "Transportation"
      },
      {
        "id": "",
        "name": "Government"
      }
    ]
  },
  "external_refs": [
    "https://hunt.io/blog/operation-southnet-sidewinder-south-asia-maritime-phishing",
    "https://otx.alienvault.com/pulse/68e3799426081d966136f26a"
  ]
}