Sidewinder Hackers Weaponize Nepal Protests to Spread Cross-Platform Malware

Sidewinder, a well-known advanced persistent threat (APT) group, has adapted its tactics to exploit the Nepalese protests, mounting a coordinated campaign that targets mobile and Windows users with malware and credential phishing. The campaign sees phishing lures impersonating national institutions and figures to harvest credentials from users following Nepal’s political turmoil, which was sparked by a government ban on social media and corruption accusations.

In one campaign strand, victims receive messages claimed to be from the Nepalese Emergency Service, with a spoofed domain and an email template that directs them to a fraudulent portal to submit credentials. Concurrently, Sidewinder rolled out an Android malware strain by exploiting the persona of General Ashok Sigdel, directing users to install Gen_Ashok_Sigdel_Live.apk, while another Android sample, Emergency_Help.apk, broadens the reach alongside a Windows component.

The Windows dropper EmergencyApp.exe mimics an official emergency app and, when run, installs a backdoor and searches for high‑value data, with exfiltration to playservicess[.]com; the Android payloads harvest documents, images and other files from the device. For defenders, indicators include installation logs referencing Gen_Ashok_Sigdel_Live.apk or Emergency_Help.apk, and HTTP exfiltration traces marked “—-qwerty” observed in network traffic.