The advanced persistent threat (APT) group SideWinder, with suspected ties to India, has launched a series of sophisticated cyberattacks targeting high-profile entities and strategic infrastructures across Asia, the Middle East, Africa, and Europe. Known for targeting rivals in Pakistan, Afghanistan, China, and Nepal since 2012, SideWinder has expanded its geographic reach, recently attacking entities in Bangladesh, Djibouti, Jordan, Malaysia, the Maldives, Myanmar, Nepal, Pakistan, Saudi Arabia, Sri Lanka, Turkey, and the UAE. The group’s targets span various sectors, including government, military, logistics, telecommunications, financial institutions, universities, and oil trading companies, as well as diplomatic entities in multiple countries. Central to these attacks is a new post-exploitation toolkit dubbed “StealerBot”, a modular implant designed for espionage. The attack chain begins with spear-phishing emails containing malicious attachments, leading to a multi-stage infection process that ultimately deploys StealerBot. This malware, developed with .NET, facilitates a range of espionage activities, including keystroke logging, password theft, file stealing, and privilege escalation. SideWinder employs a variety of tactics to deliver its payloads, such as remote template injection and exploiting known vulnerabilities like CVE-2017-11882. Despite being perceived as a low-skilled group due to their use of public exploits and remote access trojans (RATs), their operations reveal advanced capabilities that pose a significant threat. CTIX analysts recommend organizations observe SideWinder’s indicators of compromise (IoCs) to better detect and defend against a potential attack. These IoCs include references to malicious documents, .rtf and .lnk files, and various modules of StealerBot, along with a list of malicious domains and IPs associated with the attacks.