New Backdoor Targeting European Officials Linked to Indian Diplomatic Events

Zscaler ThreatLabz observed a low-volume, targeted cyber-espionage campaign by a previously undocumented actor named SPIKEDWINE that used malicious PDFs and an HTA to deliver a new backdoor, WINELOADER, to European diplomatic staff; the malware is modular, supports C2-driven module execution and DLL injection, and the campaign uses compromised websites and timing/evasion techniques to avoid detection, with multiple samples and hosting artifacts linked via VirusTotal.