Sidewinder Casts Wide Geographic Net in Latest Attack Spree

SideWinder, an India-linked APT active since 2012, has expanded operations across Asia, the Middle East, Africa and Europe using spear-phishing OOXML lures and remote template injection to exploit CVE-2017-11882; the group deploys a modular .NET implant called "StealerBot" that loads modules in memory to perform credential theft, screenshots, keylogging, file exfiltration, UAC bypass and other espionage activities, and Kaspersky publishes a comprehensive set of IoCs for detection.