SideWinder APT Caught Spying on India's Neighbor Gov'ts

Acronis researchers attribute a targeted spear‑phishing campaign against government and military entities in South Asia to the SideWinder APT (aka Razor Tiger). The campaign registers numerous C2 domains and delivers malicious RTF attachments that leverage old but effective Microsoft Office vulnerabilities (CVE-2017-0199 and CVE-2017-11882) with contextual checks (geofencing, HTTP header validation) to selectively deploy a .NET modular espionage toolkit called StealerBot, aiming to steal credentials and sensitive information from entities across Sri Lanka, Bangladesh, Pakistan, and Nepal.