SideWinder.AntiBot.Script

Group-IB reports that the SideWinder APT is conducting targeted phishing campaigns against Pakistan using a custom anti-bot script to fingerprint browsers and only deliver malicious HTA payloads to likely Pakistani victims; the chain uses ZIP/LNK -> HTA -> DLL side‑loading to install a backdoor, and the report provides extensive IOCs (92 IPs, many malicious URLs, and a sample SHA‑1) to aid detection and mitigation.