SideWinder APT Shifts to PDF/ClickOnce Chain to Target South Asian Diplomacy with StealerBot

SideWinder APT has shifted to a PDF/ClickOnce infection chain to target South Asian diplomacy, aiming at embassies and government institutions in India, Pakistan, Bangladesh, and Sri Lanka. The campaign, first detected in September 2025, comprises four major phishing waves from March to September 2025, delivering two espionage tools—ModuleInstaller and StealerBot—via fake PDF and Word documents masquerading as official communications.

According to Trellix Advanced Research Center, the latest operation uses a PDF lure that triggers a signed ClickOnce application from a C2 domain, with the attackers abusing a legitimate MagTek Inc. signature through DLL side-loading and rebranding a reader utility as “Adobe Compatibility Suite.” The malware chain deploys a DEVOBJ.dll loader (decrypting an encrypted payload

with a 42-byte XOR key) to fetch App.dll and then ModuleInstaller, which enumerates components including wdscore.dll and IPHelper.dll, with StealerBot exfiltrating system data and credentials. Trellix notes extensive OPSEC measures, including geofencing to deliver payloads only to South Asia and 404 responses for non-target regions, to hinder research and detection.