Sidewinder Hackers Weaponize Nepal Protests to Spread Cross-Platform Malware

Sidewinder, an APT group, is conducting a coordinated campaign tied to Nepal’s political protests that uses social engineering and impersonation of national institutions to distribute Android APKs (Gen_Ashok_Sigdel_Live.apk, Emergency_Help.apk) and a Windows dropper (EmergencyApp.exe). The malware masquerades as official emergency resources, harvests documents and media, exfiltrates data to playservicess.com, and uses identifiable forensic artifacts (e.g., PDB paths, staging web paths, and an HTTP multipart boundary marker “—-qwerty”) that defenders can monitor and block.