SideWinder’s Multiphase Polymorphic Attack Hits Pakistan and Turkey: Exploring the Impact and Scope of the Incident

India’s SideWinder advanced persistent threat group (APT) has expanded its target range beyond Southeast Asia to include Pakistani government officials and individuals in Turkey, according to researchers at BlackBerry Threat Research and Intelligence team. The group uses polymorphism techniques to bypass traditional signature-based antivirus detection to deliver a next-stage payload. The attacks use content-targeted documents that exploit a remote template injection flaw to deliver malicious payloads. SideWinder‘s main targets have been Pakistani military infrastructure since 2012, but the group appears to be expanding its war on Indian espionage interests. Server-side polymorphism is a technique used since the 1990s to evade detection by AV tools and makes detection challenging since each new download has a new hash, which “effectively breaks hash-based detections used by security operations centers (SOCs) and some endpoint scanners,” said Dmitry Bestuzhev, senior director of cyber-threat intelligence at BlackBerry. Organizations can mitigate these attacks by focusing on meaningful tactics, techniques, and procedures (TTPs) and behaviors in the system or code blocks covered by machine learning technologies.

Cybersecurity–cybersecurity,attack,SideWinder,multiphase,polymorphic,Pakistan,Turkey,impact,scope