APT Sidewinder Abuses Netlify to Mimic Government and Military Portals in South Asia

- Research using Hunt.io pivoting uncovered an automated, multilingual phishing framework operating across Chinese, English, and Japanese clusters that lures victims with bureaucratic/tax/HR-themed ZIP/RAR files and leverages shared scripts (download.php, visitor_log.php) and reusable infrastructure (multiple .vip/.xin/.sbs domains and Kaopu Cloud-hosted IPs); the report lists 28 webpages, multiple domains and IP IOCs, maps observed behavior to MITRE ATT&CK techniques, and provides mitigation guidance for blocking, detection, and user awareness.