Cyber advisory warns against dual-format document exploitation and typosquatting
SideWinder APT Targets Bangladesh Government Infrastructure
- BGD e-GOV CIRT issues high-severity advisory on active SideWinder spear-phishing campaigns
An Advanced Persistent Threat (APT) group linked to India called Sidewinder has been carrying out cyber attacks targeting the government, military and diplomatic sectors of Bangladesh.
On Thursday, July 30, the government's cyber security watchdog BGD e-GOV CIRT issued a warning about the group's active and growing spear-phishing campaign.
It has issued a high-severity cyber threat advisory alerting organizations against an active spear-phishing campaign by SideWinder, a persistent APT group with suspected India-nexus affiliations. Between April 21 and July 28, 2026, the threat actors established a massive typosquatting infrastructure consisting of 11 parent domains and over 60 subdomains mimicking government institutions across South Asia, with Bangladesh identified as a primary target.
In Bangladesh, the campaign explicitly impersonates at least nine key institutions, including the Ministry of Foreign Affairs (MoFA), Ministry of Defence (MoD), Ministry of Home Affairs (MoHA), Directorate of Secondary and Higher Education (DSHE), Cabinet Division, Bangladesh Navy, and the Embassy of Bangladesh in Ankara. The attack vector employs weaponized Microsoft Word (DOCX) and PDF documents functioning symmetrically as initial payload delivery and tracking mechanisms.
Technical analysis reveals the concurrent operation of two delivery kits: one leveraging OLE Remote Template Injection and the other exploiting a legacy Microsoft Office vulnerability (CVE-2017-0199). In addition to weaponized attachments, attackers are circulating clean decoy reports alongside malicious counterparts to bypass traditional sandboxing. Authorities strongly recommend patching legacy Office installations, disabling automatic remote template fetching, and sinkholing all documented IOCs.
//DBTech/Report/SME//
An Advanced Persistent Threat (APT) group linked to India called Sidewinder has been carrying out cyber attacks targeting the government, military and diplomatic sectors of Bangladesh.
On Thursday, July 30, the government's cyber security watchdog BGD e-GOV CIRT issued a warning about the group's active and growing spear-phishing campaign.
It has issued a high-severity cyber threat advisory alerting organizations against an active spear-phishing campaign by SideWinder, a persistent APT group with suspected India-nexus affiliations. Between April 21 and July 28, 2026, the threat actors established a massive typosquatting infrastructure consisting of 11 parent domains and over 60 subdomains mimicking government institutions across South Asia, with Bangladesh identified as a primary target.
In Bangladesh, the campaign explicitly impersonates at least nine key institutions, including the Ministry of Foreign Affairs (MoFA), Ministry of Defence (MoD), Ministry of Home Affairs (MoHA), Directorate of Secondary and Higher Education (DSHE), Cabinet Division, Bangladesh Navy, and the Embassy of Bangladesh in Ankara. The attack vector employs weaponized Microsoft Word (DOCX) and PDF documents functioning symmetrically as initial payload delivery and tracking mechanisms.
Technical analysis reveals the concurrent operation of two delivery kits: one leveraging OLE Remote Template Injection and the other exploiting a legacy Microsoft Office vulnerability (CVE-2017-0199). In addition to weaponized attachments, attackers are circulating clean decoy reports alongside malicious counterparts to bypass traditional sandboxing. Authorities strongly recommend patching legacy Office installations, disabling automatic remote template fetching, and sinkholing all documented IOCs.
//DBTech/Report/SME//
