Threat Intelligence

All About malware

[Threat Intelligence @threatintelbot]

Sidewinder APT targeting Nepal Army.
IOC:
271b093c62e9c4182b925e08f9cb646e

[International Cyber Digest @IntCyberDigest]

Here's the link, have fun: https://t.co/wWqz7rVzFw

[Demon @volrant136]

🚨 #APT #Sidewinder targets Bangladesh Air Force using Fake #Zimbra Page.

Using HuntSQL, I crafted the URL regex to search for similar cluster and found 1 more domain.

Hosted URL:
https://mail-baf-mil-bd-account-data-files-document[.]pages[.]dev/

@Huntio @500mk500 https://t.co/Vc8rK8dcPF

[Demon @volrant136]

#Huntio #Threathunting #Phishing | Possible #APT #Sidewinder targets Nepal Government.

Page Title: "Zimbra Web Client Sign In"

IoCs:
https://mail-mod-gov-np-account-file-data[.]netlify[.]app/bof.html

@500mk500 @Cyberteam008 @ginkgo_g @MichalKoczwara @malwrhunterteam

[Demon @volrant136]

#APT #Sidewinder | A recent #FOFA hunt uncovered new domains mimicking key #Pakistani entities.

🐦Query : https://t.co/cBQ2PtHK5X

🧩 Targets include:

1. Punjab Govt -> punjab-pk[.]org
2. Punjab Police -> punjabpolice-pk[.]org
3. Karachi Port Trust (KPT) -> kptgov[.]org
4. Bank of Punjab -> punjab-bankpk[.]org
5. Aga Khan University (AKU) -> aku-edu-pk[.]org
6. Samaa TV -> samaa-tv[.]com,
7. PK Media -> news-pk-media[.]news
+
8. Potential C2: vmi2186317[.]contaboserver[.]net
9. Generic Turkish Phish -> turkavic[.]org :
10: Generic Police Phish-> alphapolice[.]org

IPs:
162.252.173.31
162.252.174.213
151.236.20.64
162.252.172.118
162.252.174.168
162.252.172.74
162.252.172.63
151.236.16.104
149.154.158.171
213.199.62.247

@MichalKoczwara @500mk500 @malwrhunterteam

[Demon @volrant136]

#FOFA #ThreatHunting | #APT #Sidewinder

Query: title=="Arms License Verification"
IoC: https://t.co/oIeutjW7eU

ref: https://t.co/oMrEAjwgP4

@500mk500 @Cyberteam008 @ginkgo_g
@MichalKoczwara @malwrhunterteam

[Demon @volrant136]

#ZoomEye #ThreatHunting | #APT #Sidewinder impersonating Pakistan Single Window (PSW).

Query: title=="PSW" && asn="AS47583"

IoC:
psw-gov-pk[.]net

@500mk500 @Cyberteam008 @ginkgo_g
@MichalKoczwara @malwrhunterteam @zoomeye_team

[Demon @volrant136]

#ZoomEye #ThreatHunting | #APT #Sidewinder targeting Pakistan National Aerospace Science and Technology Park (#NASTP).

Queries:
1/http.header_hash="95cde7eef14ed25e60629399595d9a03"
2/
http.body="2082/unprotected/nc-cpanel/nc-livechat/live-chat.php?" && domain="*-gov*.com"

IoC: nastp-govpk[.]com

@500mk500 @Cyberteam008 @ginkgo_g @MichalKoczwara @malwrhunterteam @zoomeye_team

[Yogesh Londhe @suyog41]

Sidewinder

Invitation - 54th CISM World Military Naval Pentathlon Championship 2025.docx
5fc21db8fec77b97d3e86f4dc0ec38ce

C2
army-lk[.]info

#Sidewinder #APT #IOC

[Demon @volrant136]

#Validin #ThreatHunting | #APT #Sidewinder targeting Government of #Pakistan, #Srilanka & #Bangladesh.

#IoCs:
pubad[.]gov[.]lk[.]mofa-govtpk[.]net
gov[.]lk[.]mofa-govtpk[.]net
cbsl[.]lk[.]mofa-govtpk[.]net
presidentsoffice[.]lk[.]mofa-govtpk[.]net
lk[.]mofa-govtpk[.]net
cabinet[.]gov[.]bd[.]mofa-govtpk[.]net
mod[.]gov[.]bd[.]mofa-govtpk[.]net
bgb[.]gov[.]bd[.]mofa-govtpk[.]net
mopa[.]gov[.]bd[.]mofa-govtpk[.]net
mofa[.]gov[.]bd.mofa-govtpk[.]net
gov[.]bd[.]mofa-govtpk[.]net
bd[.]mofa-govtpk[.]net

@500mk500 @Cyberteam008 @ginkgo_g
@MichalKoczwara @malwrhunterteam @ValidinLLC

[Demon @volrant136]

#Validin #ThreatHunting | #APT #Sidewinder targeting Government of #Bangladesh.

#Query:
"চা��রির খবর ২০২৫ | সরকারি ও প্রাইভেট চাকরির খবর ২০২৫ | সকল নিয়োগ সার্কুলার ২০২৫"

"আবেদন ফরম "

#IoCs:
bd-govt[.]info
bd-govt[.]com
bdgovt[.]com
brebd-govt-bd[.]online
188.114.96.0
188.114.97.0
188.114.97.3
209.74.67.30

@500mk500 @Cyberteam008 @ginkgo_g
@MichalKoczwara @malwrhunterteam @ValidinLLC

[∂≈∞ --- ∫∫∫∆∏∑∫∫∫ π⃜÷⃜×⃜•⃜|⃜¶⃜∆⃜$⃜%⃜|⃜+⃜ @liontarakos]

"New #Linux #Security Flaw Uses Initramfs to Inject #Malware - OMG! #Ubuntu"
#7com1068 #cybersec #infosec https://t.co/hIN9kE9HPI

[hanzo @hanzohattori91]

malware c2 panel vulnerable to SQL Injection xD

http://179[.]43.176[.]38/

[ClearSky Cyber Security @ClearskySec]

New old Oilrig sample, talks to winodwsupdates\.me (first seen here https://t.co/TJHhnPOtFG).

Sample:
https://t.co/YzraDIlDem

Drops: conhost.exe
https://t.co/0e6x7I97De

More details in "Raw Threat Intelligence":
https://t.co/WA1VUqqIQE

[INTELECA @INTELECA_VZLA]

WordPress sigue infectado con malware
https://t.co/5e7xN2QFhR

[Lukas Stefanko @LukasStefanko]

More BankBots were found on Google Play targeting 160+ mobile banking apps from all around the world 🇦🇹🇺🇸🇩🇪🇵🇱🇨🇿🇪🇸🇫🇷🇳🇿🇵🇹🇫🇯🇦🇺

It wouldn't be possible to do this research without @virqdroid and @SfyLabs.
https://t.co/E9U5NXy3gl

[Europol @Europol]

Protect your mobile device against web-based threats! 📱⚠️ Learn how with our infographic: https://t.co/vdji6c0T3d Find more advice on #MobileMalware on https://t.co/rb7YkMArlg #cybercrime #CyberSecurity