The eruption of widespread protests across Nepal in early September 2025 provided fertile ground for a sophisticated campaign orchestrated by the Sidewinder APT group.

As demonstrators mobilized against government policies and social media restrictions, threat actors exploited the turbulence to distribute malicious applications masquerading as legitimate emergency services.

Victims seeking live updates or assistance were enticed by realistic impersonations of Nepalese authorities, only to install malware that siphoned sensitive data from both mobile and Windows environments.

Sidewinder’s operation relies on a dual-pronged delivery mechanism. On Android devices, victims encounter phishing websites spoofing the Nepalese Emergency Service login.

Once credentials are entered, the site redirects to an APK download—typically named Gen_Ashok_Sigdel_Live.apk—which users install under the guise of accessing live news.

Meanwhile, Windows users download EmergencyApp.exe from a cloned Emergency Helpline portal (Figure 6). Both binaries request extensive permissions—file system access, microphone, camera—to facilitate data exfiltration.

StrikeReady Labs analysts noted the group’s deliberate use of geopolitical events to maximize engagement, embedding the malicious payload within decoy content fetched from reputable outlets such as Al Jazeera.

These decoys lend credibility to the operation and help the malware bypass cursory inspection by non-technical users. Once installed, the mobile backdoor initializes a service that filters document and image files for exfiltration.

The Windows variant operates similarly, spawning background tasks that harvest files with extensions like .docx, .pdf, and .xlsx.

Infection Mechanism and Permission Abuse

A closer examination of the Android sample reveals a multi-threaded FileUploadService class responsible for data theft.

Upon execution, the service initializes an ExecutorService with a thread pool of fifteen workers. Each worker scans device storage for files matching predefined document and image extensions:

public class FileUploadService extends Service {
  private static final int THREAD_COUNT = 15;
  private final List<String> docExts = Arrays.asList(".txt", ".pdf", ".docx", ".xlsx");
  private final List<String> imgExts = Arrays.asList(".jpg", ".png");
  private ExecutorService executorService;

  @Override
  public int onStartCommand(Intent intent, int flags, int startId) {
    executorService = Executors.newFixedThreadPool(THREAD_COUNT);
    scanAndUpload();
    return START_STICKY;
  }

  private void scanAndUpload() {
    for (String ext : docExts) {
      // Launch tasks to upload matching files
      executorService.submit(() -> uploadFiles(ext));
    }
    for (String ext : imgExts) {
      executorService.submit(() -> uploadFiles(ext));
    }
  }
}

Once files are identified, HTTP POST requests bundle them into multipart form data, using a recognizable boundary marker (----qwerty) that appears in the network capture.

All stolen files are sent to https://playservicess.com/dtta/files.php, a C2 endpoint controlled by Sidewinder. Persistence is maintained through Android’s foreground service notifications and Windows autostart registry entries.

By leveraging legitimate-seeming user interfaces and abusing high-level permissions, Sidewinder achieves a stealthy infection vector capable of breaching enterprise and personal environments alike.

Security teams should monitor for known IOC domains (e.g., playservicess.com), suspicious APK installations, and anomalous outbound traffic containing multipart payloads.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Sidewinder APT Hackers Leverage Nepal Protests to Push Mobile and Windows Malware appeared first on Cyber Security News.

Cybercriminals are increasingly exploiting legitimate remote monitoring and management (RMM) tools to establish persistent access to compromised systems through sophisticated phishing campaigns.

Joint research conducted by Red Canary Intelligence and Zscaler threat hunters has identified multiple malicious campaigns utilizing ITarian (also known as Comodo), PDQ, SimpleHelp, and Atera RMM solutions as attack vectors.

The appeal of RMM tools for adversaries lies in their inherent legitimacy within enterprise environments, where IT professionals routinely deploy these solutions for remote access, system monitoring, and machine management.

This veneer of authenticity allows threat actors to operate stealthily without triggering immediate security alerts, as their activities often blend seamlessly with legitimate administrative tasks.

Red Canary analysts identified four primary social engineering lures that have proven successful in convincing targets to download malicious RMM tools onto their systems.

These include fake browser updates, meeting invitations, party invitations, and fraudulent government forms.

The researchers also discovered a concerning trend where adversaries deploy two RMM tools in rapid succession, effectively establishing multiple persistent access methods to ensure continued control over compromised environments.

The campaigns demonstrate sophisticated targeting mechanisms, with threat actors specifically focusing on Windows desktop users while filtering out mobile devices.

The attack infrastructure includes command and control servers that collect browser fingerprinting data, geolocation indicators, and engagement metrics to optimize campaign effectiveness.

Advanced Infection Mechanisms and Payload Delivery

The technical sophistication of these attacks becomes evident through their multi-layered infection mechanisms.

In the fake browser update campaigns, adversaries inject malicious JavaScript into compromised websites that create full-screen overlay attacks.

The injected code uses maximum z-index values (2147483647) to ensure the fake update prompt appears above all other page elements, effectively trapping users within the malicious interface.

The JavaScript payload performs dynamic iframe creation, loading content from suspicious domains including chromus[.]icu and mypanelsuper[.]online while maintaining redundancy through multiple fallback URLs.

This approach ensures campaign continuity even when individual domains are blocked by security controls.

The malicious code also implements data exfiltration capabilities, sending browser fingerprinting data, geolocation indicators, and unique tracking hashes to command and control servers.

Once users interact with these lures, they unknowingly download legitimate RMM installers that have been weaponized through adversary-controlled tenants.

For instance, ITarian installations execute through URLs containing redacted tenant identifiers, allowing the downloaded MSI files to contact additional domains and execute secondary payloads.

The ITarian application, operating as RmmService.exe, has been observed launching malicious processes like DicomPortable.exe and establishing registry modifications for persistence.

The sophistication extends to payload deployment, where threat actors utilize techniques such as DLL sideloading through legitimate signed binaries.

In documented cases, DicomPortable.exe sideloaded malicious Qt5Core.dll using software signed by Apowersoft Ltd, subsequently deploying HijackLoader for further compromise activities.

This approach leverages code-signing trust mechanisms to bypass security controls while delivering information stealers and additional remote access tools.

Detection of these campaigns requires monitoring for RMM tools executing child processes from unusual directories, particularly when these tools are not typically authorized within the environment.

Organizations should maintain strict allowlists for legitimate RMM deployments and implement network controls to identify suspicious newly registered domains hosting these malicious campaigns.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Threat Actors Leverage Several RMM Tools in Phishing Attack to Maintain Remote Access appeared first on Cyber Security News.

A sophisticated pro-Russian cybercriminal group known as SectorJ149 (also identified as UAC-0050) has emerged as a significant threat to critical infrastructure worldwide, conducting targeted attacks against manufacturing, energy, and semiconductor companies across multiple nations.

The group’s activities represent a strategic shift from traditional financially motivated cybercrime to geopolitically driven operations that align with broader Russian state interests during the ongoing conflict with Ukraine.

The threat actor has demonstrated remarkable adaptability by purchasing customized malware from dark web marketplaces and black markets, integrating these tools into comprehensive attack campaigns that span continents.

Recent investigations reveal that SectorJ149 has successfully infiltrated organizations in South Korea, Ukraine, and other strategic allies, focusing particularly on companies involved in secondary battery production, semiconductor manufacturing, and critical energy infrastructure.

NSHC ThreatRecon Team analysts identified the group’s sophisticated methodology through correlation analysis of multiple attack campaigns, revealing consistent tactics, techniques, and procedures (TTPs) across different geographical targets.

The researchers noted striking similarities between attacks on Ukrainian insurance and retail companies in October 2024 and subsequent operations targeting South Korean manufacturing firms in November 2024, suggesting coordinated campaign planning and resource sharing within the organization.

The group’s operations extend beyond traditional cybercriminal activities, incorporating hacktivist elements that serve Russian strategic objectives.

This evolution reflects the increasingly blurred lines between state-sponsored operations and cybercriminal enterprises, particularly during periods of heightened geopolitical tension.

The attacks have successfully compromised sensitive industrial data, intellectual property, and operational capabilities across targeted sectors.

Initial evidence suggests that SectorJ149’s activities may be part of a broader Russian strategy to undermine allied nations’ industrial capabilities while gathering intelligence on critical technologies and infrastructure.

The timing and target selection demonstrate sophisticated intelligence gathering and strategic planning capabilities that exceed typical cybercriminal operations.

Attack Methodology and Infrastructure Exploitation

SectorJ149 employs a multi-stage attack methodology that begins with carefully crafted spear phishing emails targeting executives and key personnel within manufacturing organizations.

The group demonstrates exceptional social engineering capabilities, customizing email content to match specific company operations and industry terminology.

These emails typically contain compressed CAB files disguised as legitimate business documents, such as quotation requests or production facility purchase inquiries.

Upon execution, the malicious payload deploys Visual Basic Script (VBS) malware that executes obfuscated PowerShell commands.

The PowerShell implementation includes sophisticated failover mechanisms, randomly connecting to either Bitbucket or GitHub repositories to download steganographically concealed malware components.

The code snippet demonstrates the group’s technical sophistication: the malware downloads image files containing hidden executable code, which is then extracted using Base64 decoding techniques marked with specific delimiters.

The final payload employs process hollowing techniques, injecting malicious code into legitimate Windows processes such as RegAsm.exe.

This approach enables the malware to maintain persistence while evading detection by security solutions.

The group utilizes registry modifications in HKEY_CURRENT_USER keys to ensure continued system access, implementing both Run and RunOnce configurations depending on operational requirements.

The infrastructure supporting these operations leverages legitimate cloud services and open-source platforms, making detection and attribution challenging for security teams.

This sophisticated approach demonstrates the group’s understanding of modern security environments and their ability to adapt traditional attack methods for contemporary threat landscapes.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Pro-Russian Hackers Attacking Key Industries in Major Countries Around The World appeared first on Cyber Security News.