SideWinder Launches ClickOnce Attack on South Asian Diplomats

A European embassy in New Delhi and several organizations in Sri Lanka, Pakistan, and Bangladesh were targeted by the SideWinder threat actor in September 2025. This campaign marks a significant evolution in SideWinder’s tactics, techniques, and procedures (TTPs), notably utilizing a new PDF and ClickOnce-based infection chain.

Want More Context? 🔎