Rewterz Threat Alert – APT SideWinder Group Targeting Pakistani Officials – Active IOCs

Severity

High

Analysis Summary

The SideWinder Advanced Persistent Threat (APT) group is active again and targeting top level Pakistani officials for espionage campaigns. This time they are targeting Pakistan at a very crucial stage when the geopolitical situation of the region is critical and USA has left Afghanistan handing over the reigns to Taliban after 20 years of fighting. Threat actors are taking this as an opportunity to gather sensitive information wrt to the ongoing fiasco and peace talks between two countries and have dropped their malicious document highlighting the role of Pakistan and security measures taken for the stability of the region. This come as a threat to national security when Pakistan is playing a key role in maintaining peace in Afghanistan and emerged as a mediator between the USA and Taliban.

Impact

• Information Theft and Espionage

Indicators of Compromise

Filename

• 4241-267 dt 3 Sep 21[.]docx

MD5

• ee9866864d026e695bf49231a43b521f

SHA-256

• da08044373bc9bd54fd2ead9705446917e8f6e53d32f0885854e720e601cdbef

SHA-1

• 841cdc3a30d9f21963946c52180e593cc3aa3d05

Remediation

• Block all threat indicators at your respective controls.
• Search for IOCs in your environment.