SideWinder Leverages ClickOnce Installer to Deliver StealerBot Malware

The notorious SideWinder advanced persistent threat (APT) group has evolved its cyber espionage tactics with a sophisticated new attack method, combining PDF lures with ClickOnce technology to deploy StealerBot malware against diplomatic targets across South Asia.

SideWinder orchestrated a carefully planned phishing operation throughout 2025, deploying customized lures designed for specific diplomatic institutions.

The campaign’s primary objective centered on deploying ModuleInstaller and StealerBot malware to conduct espionage activities against government entities.

The first wave targeted Bangladeshi institutions between March and April with documents bearing titles like “Registration Form.pdf” and “Hajj training 2025.pdf.”

Victims encountered documents requiring them to download a purported “latest Adobe Reader version” through embedded buttons.

The Trellix Advanced Research Center (ARC) uncovered this campaign in September 2025 after detecting attacks on a European embassy in New Delhi, India, with further investigation revealing victims spanning Sri Lanka, Pakistan, and Bangladesh.

The attackers registered domains incorporating Bangladeshi organizations and events, including hajjtraining2025[.]moragovt[.]net and cadetcollege[.]adobeglobal[.]com, lending false legitimacy to their infrastructure.

Pakistani diplomats became targets in the second wave from April through August, coinciding strategically with the May 2025 India-Pakistan conflict. SideWinder employed both fake Adobe Reader updates and malicious Microsoft Word documents exploiting CVE-2017-0199.

Documents such as “Induction of Weapons in CSD for Officers and JCOs.pdf” were distributed through domains like pimec-paknavy[.]updates-installer[.]store and cabinet-gov-pk[.]dytt888[.]net.

Sri Lankan authorities faced attacks during the third phase between June and September, receiving documents titled “Annual Transfers of Officers in the Joint Services 2026.pdf” and “Promotion of officers in Grade I.pdf.” The attackers utilized domains including www-treasury-gov-lk[.]snagdrive[.]com to host malicious payloads.

The fourth wave in September targeted embassy diplomats from multiple countries stationed in India.

Emails originated from mod[.]gov[.]bd[.]pk-mail[.]org, impersonating Pakistan’s Ministry of Defense, while distributing documents like “Inter-ministerial meeting Credentials.pdf” and “India-Pakistan Conflict -Strategic and Tactical Analysis of the May 2025.docx.”

Interestingly, delivery domains referenced Bangladeshi government institutions rather than Pakistani ones, suggesting either operational error or deliberate misdirection.

Technical Innovation: ClickOnce Exploitation

SideWinder’s adoption of ClickOnce technology represents a significant tactical evolution. When victims click the button within the malicious PDF, a ClickOnce application downloads from the command and control server.

While SideWinder has historically used malicious Word documents to initiate infections, this campaign’s PDF/ClickOnce chain is the newest and sophisticated vector in their arsenal. 

The threat actors implemented geofencing to block analysis attempts from outside targeted regions, while dynamically generating request paths to frustrate security research efforts.

The September campaign featured ClickOnce applications bearing valid signatures from MagTek Inc., preventing Windows security alerts.

Rather than stealing MagTek’s signing certificate, SideWinder cleverly repurposed the legitimate MagTek ReaderConfiguration.exe application to sideload malicious components.

Windows verifies signatures only for designated installation binaries, allowing unsigned DLLs downloaded separately to evade detection.

The attackers systematically compromised MagTek Reader Configuration version 1.5.13.2, replacing the authentic public key token with null values while maintaining valid certificate chains.

They substituted MagTek branding with Adobe Reader iconography, rebranding the application as “Adobe Compatibility Suite” to match the email lure. Deployment infrastructure shifted from legitimate MagTek servers to attacker-controlled domains like filenest[.]live.

Multi-Stage Malware Delivery Chain

The malicious payload delivery mechanism involves replacing legitimate JSON configuration files with DEVOBJ.dll, which serves as a sideloading vector for the multi-stage StealerBot infection.

Once executed, DEVOBJ.dll locates an encrypted payload file with randomly generated filename extensions. Decryption employs simple XOR operations using the first 42 bytes of the encrypted file as the key.

The decrypted file functions as a lightly obfuscated .NET loader, downloading ModuleInstaller from the command and control server. To evade antivirus detection, the loader executes ModuleInstaller directly or through mshta.exe for Avast/AVG products, or pcalua.exe for Kaspersky installations.

ModuleInstaller, previously analyzed by cybersecurity vendors including Kaspersky, has remained largely unchanged since initial discoveries, even retaining spelling errors like “McAfee” misspellings.

After profiling the victim system, ModuleInstaller downloads configuration files including TapiUnattend.exe, a legitimate application used for DLL sideloading, wdscore.dll loader, encrypted files, and IPHelper.dll library for managing proxy communications.

The final payload, StealerBot, emerges after TapiUnattend.exe sideloads wdscore.dll, which then XOR decrypts an encrypted file using its first 21 bytes as the key. StealerBot supports multiple plugins to expand functionality, though Trellix researchers could only retrieve IPHelper.dll due to infrastructure restrictions.

SideWinder demonstrated sophisticated operational security measures throughout this campaign. Geofenced payload delivery restricted all HTTPS requests for second-stage payloads by geolocation, serving 404 errors to IP addresses outside target regions.

Dynamic URLs containing random components were generated per victim session, with ClickOnce manifests listing expected component hashes updated on-the-fly for each download.

Payload availability was time-locked, with certain URLs remaining active only briefly after ClickOnce application delivery.

Dedicated infrastructure featured unique domains for each wave or target set, most dropped quickly after use. The combination of these measures significantly limited the lifespan of traditional indicators of compromise like file hashes and domain names.

Attribution and Implications

Trellix attributes this campaign to SideWinder with high confidence based on consistent victimology targeting public administration entities in Sri Lanka, Pakistan, and Bangladesh—countries frequently in SideWinder’s crosshairs due to regional geopolitical tensions.

The domain updates-installer[.]store has been consistently linked to SideWinder operations by Acronis and other security researchers.

The deployment of proprietary ModuleInstaller and StealerBot malware, extensively documented in previous SideWinder attacks, provides additional attribution evidence.

The tactics, techniques, and procedures align perfectly with SideWinder’s established modus operandi, including phishing email structure, fake Adobe Reader lures, and CVE-2017-0199 exploitation.

This investigation underscores the critical need for robust security measures in government sectors across targeted regions.

SideWinder’s geofencing techniques and use of valid signatures from compromised legitimate applications demonstrate deliberate efforts to bypass common security detections and maintain operational secrecy.

Organizations in South Asia must remain vigilant against these evolving sophisticated threats targeting diplomatic and governmental institutions.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.