Advisory ID: ngCERT-2025-050007
Probability: High
Damage: Critical
Platform(s): Microsoft Office
SUMMARY
ngCERT warns of a marked intensification in cyber espionage activities by SideWinder (aka Rattlesnake or *T-APT-04*), a state-aligned advanced persistent threat (APT) group. Historically focused on government and military entities, the group has now expanded its operations to target maritime, logistics, telecommunications, and financial institutions across Africa and Asia. This shift underscores heightened risks to critical infrastructure and economic stability in these regions.
DESCRIPTION
The key tactics and exploits include:
Weaponized Phishing Campaigns:
- SideWinder distributes spear-phishing emails containing malicious Microsoft Office documents engineered to exploit memory corruption vulnerabilities (CVE-2017-11882, CVSS 7.8 – High; CVE-2018-0802, CVSS 7.8 – High). These documents execute arbitrary code to compromise systems.
- Open XML (OOXML) File Abuse:
Malicious OOXML files bypass legacy security controls to deploy payloads. - Post-Exploitation Malware:
After initial access, the group deploys custom tools like StealerBot (data-harvesting malware) and advanced Remote Access Trojans (RATs) to exfiltrate sensitive data, establish persistence, and pivot laterally within networks.
CONSEQUENCES
This could further result in:
- Operational Disruption: Compromised systems in logistics or maritime sectors could halt critical supply chains.
- Financial Loss: Theft of banking credentials or intellectual property from financial institutions.
- National Security Threats: Exfiltration of government/military data or sabotage of telecom infrastructure.
SOLUTION/MITIGATION
ngCERT recommends the following:
- Patch Legacy Systems: Prioritize updates for Microsoft Office vulnerabilities (CVE-2017-11882, CVE-2018-0802).
- Block Suspicious OOXML Files: Use email filtering to quarantine documents with macros or unusual metadata.
- Enforce Multi-Factor Authentication (MFA): Limit lateral movement via compromised credentials.
- Monitor for Lateral Movement: Deploy endpoint detection (EDR) and network traffic analysis tools.
- Train Staff: Simulate phishing attacks to raise awareness of malicious document tactics.
- Adopt a Zero Trust security framework to verify all access and restrict to the minimum necessary permissions.
Urgency!!!
With SideWinder’s evolving capabilities and cross-sector targeting, organizations in affected regions face high-severity risks (CVSS 7.8–9.0 contextual scores). Proactive defense is critical to preempt large-scale breaches.
REFERENCES