Executive Summary

SideWinder, a persistent advanced persistent threat (APT) group with suspected India-nexus affiliations, is conducting an active spear-phishing campaign targeting government organizations across South Asia, with Bangladesh identified as one of its primary targets. Between 21 April and 28 July 2026, the threat actor established an extensive typosquatting infrastructure consisting of 11 parent domains and more than 60 impersonation subdomains designed to mimic government entities across Bangladesh, Sri Lanka, Nepal, and Pakistan. Additional lure infrastructure has also been observed impersonating organizations associated with China, the United Arab Emirates, United States embassies, and the United Nations (UNOCHA).

For Bangladesh, the campaign has been confirmed to impersonate at least nine government entities, including the Ministry of Foreign Affairs (MoFA), Ministry of Defence (MoD), Ministry of Home Affairs (MoHA), Directorate of Secondary and Higher Education (DSHE), Ministry of Civil Aviation and Tourism, Cabinet Division, Bangladesh Navy, and the Embassy of Bangladesh in Ankara, in addition to a punycode (IDN homograph) variant of the official MoFA domain. This activity builds upon previously documented SideWinder operations targeting several high-profile Bangladeshi organizations, including the Bangladesh Telecommunication Regulatory Commission (BTRC), Directorate of Inter-Services Public Relations (ISPR), Ministry of Finance, Directorate General of Defence Purchase (DGDP), Directorate General of Forces Intelligence (DGFI), Bangladesh Air Force, Bangladesh Police, and the national government webmail portal (mail.gov.bd). The observed activity demonstrates a sustained and evolving espionage campaign against Bangladesh's government, defence, and diplomatic sectors.

The current campaign employs weaponized Microsoft Word (DOCX) and PDF documents as active malware delivery and victim-tracking mechanisms. Notably, the attackers continue to exploit the Microsoft Office Remote Template Injection vulnerability (CVE-2017-0199), highlighting the continued effectiveness of unpatched legacy vulnerabilities in targeted attacks. This advisory provides an assessment of the threat, outlines the associated tactics, techniques, and procedures (TTPs), presents Bangladesh-related indicators of compromise (IOCs), and recommends mitigation measures to reduce the risk of compromise.

Assessment: The likelihood of continued targeting of Bangladeshi government, defence, and diplomatic organizations by SideWinder is assessed as High. The confirmed impersonation of multiple government institutions, combined with the group's established history of credential theft and malware deployment against Bangladeshi entities, indicates an ongoing and persistent cyber espionage campaign requiring heightened vigilance and immediate defensive measures.

Download as PDF

Campaign Overview

· Window: 21 April 2026 – 28 July 2026, and ongoing at time of writing.

· Confirmed compromised/targeted countries: Bangladesh, Sri Lanka, Nepal, Pakistan.

· Lure-only / staged / adjacent infrastructure: China (bait theme only), UAE (staged, not yet tied to confirmed compromise), UN/UNOCHA and other international-organization impersonation.

· Infrastructure scale: 11 confirmed parent domains, expanding to 60+ typosquat government/institution subdomains, following the consistent convention <agency>-gov-<cc>.<parent-domain>.

· Two concurrent delivery kits operate within the same infrastructure and target set.

· Dual-format active tracking: Both weaponized DOCX and weaponized PDF lures independently trigger file-type-matched C2 paths (/office-compatibility-suite for DOCX, /adobe-reader for PDF), meaning either file type alone is sufficient to compromise and fingerprint a victim — recipients should not treat PDF versions of a lure document as inherently safer than DOCX versions, or vice versa.

Bangladesh-Specific Targeting Analysis

Confirmed Bangladesh impersonation identities (current campaign)

Prior corroborating targeting (2024–2025 SideWinder activity against Bangladesh)

Independent of the current campaign, public reporting over the prior year documents sustained SideWinder interest in Bangladesh:

· Ministry of Defence, Bangladesh Telecommunication Regulatory Commission (BTRC), Directorate of Inter-Services Public Relations (ISPR), and Ministry of Finance were referenced in lure content and phishing infrastructure tied to the domain army-govbd[.]info, alongside confirmed targeting in Sri Lanka and Pakistan.

· A separate credential-harvesting infrastructure cluster impersonated the Directorate General of Defence Purchase (DGDP), Directorate General of Forces Intelligence (DGFI), Bangladesh Air Force (BAF), Bangladesh Ordnance Factories (BOF), the national webmail portal (mail.gov.bd), and Bangladesh Police, funneling stolen credentials to centralized backend collection domains (mailbox3-inbox1-bd[.]com, mailbox-inbox-bd[.]com) hosted on a Frankfurt-based VPS.

· Earlier 2025 telemetry (Hunt.io “Operation SouthNet”) also identified supporting SideWinder activity touching Bangladesh alongside Pakistan, Sri Lanka, Nepal, and Myanmar, using free-hosting platforms (Netlify, Pages.dev) for credential-harvesting portals.

Assessment: The current campaign is not a one-off — it is the latest iteration of at least 12–18 months of continuous, evolving SideWinder targeting of Bangladeshi government, defense, and law-enforcement institutions, with the actor progressively expanding both its impersonated-entity list (now including Cabinet Division, an overseas mission, and an education directorate) and its technical tooling (moving between credential-harvesting portals, CVE-2017-0199/CVE-2017-11882 exploitation, and now dual-format OLE template injection).

Technical Attack Chain

Two delivery kits operate concurrently against the same infrastructure and target set, including Bangladesh.

Kit 1 — OLE Remote Template Injection (DOCX and PDF)

Weaponized .docx (VHash ba8a8dcf308b74616714221e0d3b3a1e)

 -> OLE relationship (word/_rels/document.xml.rels) references external template with TargetMode="External"

 -> https://<agency>-gov-<cc>.<typosquat-domain>/office-compatibility-suite

Weaponized .pdf (VHash 9bdaee3d3d16a209244ef6d74b2e5ebb4)

 -> https://<agency>-gov-<cc>.<typosquat-domain>/adobe-reader

 -> ALL samples additionally beacon to e7[.]knd[.]vg for victim fingerprinting

Both file types independently function as active delivery and tracking vectors — opening either a Bangladesh-themed DOCX or PDF bearing these VHashes will trigger outbound contact to attacker infrastructure without requiring further user interaction beyond opening the file, provided legacy “automatically update linked data”/remote-content behaviors are not disabled at the endpoint.

Kit 2 — CVE-2017-0199 OLE2Link Exploitation

Weaponized .docx (tag: cve-2017-0199, calls-wmi)

 -> OLE2Link exploit (CVE-2017-0199, patched by Microsoft in April 2017)

 -> attacker infrastructure: download-msoffice[.]com / vagued[.]live / mail-svr[.]co / direct880[.]net / filenest[.]live

 -> sandbox family classification: "Sidewinder"

The Bangladesh Navy (bdnavy) impersonation subdomain is hosted on download-msoffice[.]com, which is part of this Kit 2 cluster — meaning Bangladesh Navy-themed lures in this campaign may be delivered via the still-effective 2017 exploit chain rather than (or in addition to) the newer template-injection method. Prior Acronis TRU reporting confirms SideWinder chains CVE-2017-0199 with CVE-2017-11882 (Equation Editor memory corruption) to deliver multistage shellcode loaders culminating in the StealerBot credential-harvesting implant — endpoints still running unpatched Office 2007–2016 installations, common in many government environments, remain fully exploitable by this technique.

Document Phishing (.eml) Using Genuine Bangladeshi Government Content

A third delivery method uses phishing emails built around genuine, publicly available documents as bait, rather than weaponized attachments. These emails explicitly reference the legitimate mofa.gov.bd domain to increase perceived legitimacy, while routing sender/reply infrastructure through attacker-controlled mail domains nih[.]mail-egov[.]org and nih[.]pk[.]mail-egov[.]org. Because the attached document itself is unweaponized, this technique is designed to bypass attachment-sandboxing and file-hash-based detection, relying instead on social engineering and domain trust — recipients should independently verify sender domains (not just the “From” display name) whenever a message purports to originate from mofa.gov.bd or any *.gov.bd address.

Decoy Pairing

Operators distribute at least one lure (the “China Power Supply Development Report 2026”) in both a clean, unweaponized version and a weaponized Kit 1 version, allowing the malicious version to be swapped in while the benign document circulates as cover. Bangladeshi recipients of any HR/circular/pay-scale-themed or training-correspondence document should assume weaponized and benign versions of the same-titled document may circulate simultaneously — file appearance and title alone are not a reliable safety indicator.

Lure Themes Relevant to Bangladesh

Based on the confirmed audience segmentation in this campaign, Bangladeshi personnel in the following roles should be considered elevated-risk recipients:

· Civil service/HR staff — HR/pay-scale/allowance/promotion notices (e.g., disparity reduction allowance, basic pay scale revisions) are a confirmed lure theme; Cabinet Division and MoHA personnel handling such circulars are plausible targets.

· Training/professional-development staff — CEH (Certified Ethical Hacker) training enquiry/acceptance correspondence is used as a lure; ironically, cybersecurity and IT staff pursuing certifications are themselves a targeted demographic.

· Military/defense personnel — the named military exercise theme (EXERCISE_CARAT_2026) and Bangladesh Navy impersonation indicate defense-exercise-themed lures are plausible against Bangladeshi military recipients.

· Diplomatic staff — MoFA and Ankara-mission impersonation indicates diplomatic-cable or circular-themed lures targeting foreign-service officers.

· Education-sector staff — DSHE impersonation suggests administrative circulars or notices are being used as lure cover for education-directorate personnel.

Cross-cutting beacon: e7[.]knd[.]vg is embedded in every Kit 1 PDF sample regardless of which parent typosquat domain delivered it — this single indicator should be blocked network-wide irrespective of which specific ministry-themed subdomain was used in a given lure.

Domains (parent typosquat infrastructure, current campaign)

fetchdrives[.]info, min-pk[.]com, interior-ministry[.]com, filenest[.]live (suspended), download-msoffice[.]com, vagued[.]live, mail-svr[.]co, pk-mailgov[.]com, fia-g0v[.]net, direct880[.]net, mail-egov[.]org, mailnavymilbd[.]govpk[.]net, mailnepalarmy[.]mofagov[.]com,

Confirmed Bangladesh-themed subdomains

mofa-gov-bd, mod-gov-bd, dshe-gov-bd, moha-gov-bd, moha-portal-gov-bd, mocat-gov-bd, bdnavy, cabinet-gov-bd, ankara-mofa-gov-bd, xn--mofagovbd-t89dd, mail-bcc-gov-bd, bccgov-bd-production, webmaii-bcc-gov-bd-newfiles, dgdp-account-file-data-doc-procuremen, mail-bof-gov-file-account-conf-files, mail-baf-mil-bd-account-data-files-document, mail-bfsa-gov-bd

Attacker mail infrastructure (document-phishing / .eml vector)

nih[.]mail-egov[.]org, nih[.]pk[.]mail-egov[.]org

Beacon / fingerprinting infrastructure

e7[.]knd[.]vg

Prior-campaign infrastructure (2024–2025, for historical correlation and retro-hunting in Bangladesh environments)

army-govbd[.]info, mailbox3-inbox1-bd[.]com, mailbox-inbox-bd[.]com (resolving to 146.70.118.226, Frankfurt), mail.gov.bd-themed phishing pages

Recommendations

· Patch legacy Microsoft Office installations against CVE-2017-0199 and CVE-2017-11882 across all in-scope ministries — these are 2017-era vulnerabilities and their continued exploitability indicates patch-compliance gaps that should be closed as a baseline hygiene measure, independent of this specific campaign.

· Disable automatic remote template/linked-data fetching in Microsoft Office via Group Policy (disable “Update Automatic Links at Open,” enforce Protected View for internet-zone documents, and block OLE package activation from untrusted sources).

·  Network/DNS-layer blocking:

o  Block/sinkhole all listed parent domains and Bangladesh-themed subdomains, IPv4 Addresses, Hashes.

o  Block the cross-cutting beacon e7[.]knd[.]vg network-wide.

o  Implement pattern-based DNS alerting for newly observed domains matching *-gov-bd*, *-gov-np*, *-gov-pk*, *-gov-lk* that do not resolve to known legitimate government IP ranges.

o  Alert on DNS queries containing punycode (xn--) prefixes combined with government-related strings.

· Email gateway rules: quarantine and sandbox-detonate DOCX/PDF attachments containing OLE relationships with TargetMode="External", and specifically flag any outbound request path matching /office-compatibility-suite or /adobe-reader observed from detonation sandboxes.

· Endpoint/EDR detection: deploy detection logic for the two confirmed VHashes , and hunt retroactively for the Adobe Acrobat DC 23.008.20470 / Document_7032 metadata pattern in mail and file-storage systems.

· Retro-hunt for the 2024–2025 legacy infrastructure (army-govbd[.]info, mailbox3-inbox1-bd[.]com, mailbox-inbox-bd[.]com) in historical DNS/proxy logs to determine whether prior compromise occurred that has gone undetected.

· Reinforce that both DOCX and PDF versions of the same document may be independently weaponized — file format is not a safety signal, and a “China Power Supply Development Report”-style dual clean/weaponized pairing shows attackers deliberately exploit this assumption.

· Train staff to verify the actual sending domain (not just display name) on any email referencing mofa.gov.bd or other *.gov.bd addresses, given the confirmed document-phishing technique that spoofs legitimate government domains while routing through attacker-controlled mail infrastructure.

References

· https://www.acronis.com/en/tru/posts/from-banks-to-battalions-sidewinders-attacks-on-south-asias-public-sector/

· https://hunt.io/blog/operation-southnet-sidewinder-south-asia-maritime-phishing

· Flavio Queiroz — THREAT CAMPAIGN: APT SideWinder multi-country spear-phishing, https://www.linkedin.com/posts/flavioqueiroz_threathunting-threatdetection-threatanalysis-activity-7361713711570427905-W8t_

· Group-IB campaign reporting, “SideWinder’s Expanding South Asian Gambit: Government Impersonation at Scale

Download as PDF