SideWinder APT Targets South Asian Governments in Sophisticated Phishing Campaign The advanced persistent threat (APT) group SideWinder has launched a highly targeted phishing campaign against government and defense organizations in South Asia, including the Bangladesh Navy and Pakistan’s Ministry of Foreign Affairs. Active since at least February 2026, the operation employs a fake Chrome PDF viewer and a pixel-perfect clone of the Zimbra email login portal to harvest credentials. ### Attack Mechanics The campaign begins with spearphishing links sent to targeted individuals. Victims are directed to a fake PDF viewer (using PDF.js v2.16.105) displaying a blurred diplomatic cable a real stolen document from Pakistan’s government related to the 152nd IPU Assembly in Istanbul. After five seconds, the page automatically redirects to a Zimbra login clone, which mirrors the legitimate Bangladesh Navy webmail portal (mail.navy.mil.bd). The phishing kit, internally named Z2FA_LTS ("Zimbra 2FA Long-Term Support"), is a server-rendered Express.js application hosted on Cloudflare Workers. It employs several deceptive tactics: - Reverse-proxied assets from the real Zimbra server to enhance authenticity. - A forced session expiration error to prompt re-login. - A double-submission trick, where the victim’s username is pre-filled after the first login attempt, tricking them into re-entering their password. ### Operational Security Failure During analysis, researchers discovered a critical OPSEC lapse: a 500 error exposed a full Express.js stack trace, revealing the developer’s Linux username (moincox) and the kit’s internal name (Z2FA_LTS). The handle moincox has no public footprint on GitHub, npm, or other code repositories. ### Infrastructure & Attribution Researchers, including @volrant136, @Huntio, and @malwrhunterteam, mapped seven distinct phishing Workers across two Cloudflare accounts (girlfriendparty42.workers.dev and malik-jaani786.workers.dev) over three months. Targets included: - Bangladesh Navy (mail.navy.mil.bd) - Pakistan’s Ministry of Foreign Affairs - Nayatel (ISP) - Bangladesh Computer Council ### Impact & Response The campaign highlights SideWinder’s evolving tactics, including session management with rotating CSRF tokens and real-time asset mirroring to evade detection. Affected organizations have been urged to rotate credentials and report the infrastructure to Cloudflare Trust and Safety for takedown. The use of stolen diplomatic documents as lures underscores the group’s focus on high-value targets in the region.