SideWinder APT Launches Operation SouthNet, Weaponizing Netlify and Pages.dev for Espionage

A new report from Hunt Intelligence reveals that APT SideWinder — one of South Asia’s most active and persistent state-sponsored threat actors — has launched an extensive cyber-espionage campaign dubbed “Operation SouthNet.” The operation focuses on credential theft, infrastructure recycling, and maritime-sector espionage across Pakistan, Sri Lanka, Nepal, Bangladesh, and Myanmar.

According to Hunt’s telemetry, over 50+ malicious domains were uncovered across Netlify, pages[.]dev, workers[.]dev, and b4a[.]run, hosting fake Outlook/Zimbra portals and credential harvesting pages designed to mimic legitimate government and defence portals. Pakistan accounts for 40% of the identified malicious domains, with lure themes such as ministerial committees, bilateral visits, and defence procurements, suggesting targets are government, military, and maritime entities.

In Nepal, phishing kits masquerade as official government portals, including one site hosting a fake Outlook login page and a lure document, with credentials exfiltrated to a Nepalese exfiltration domain. The campaign also spans Myanmar, where the Central Bank of Myanmar was targeted via a fake Zimbra Webmail login hosted on Pages[.]dev, with credential data funnelled to a long-running C2 infrastructure.