Operation SouthNet: SideWinder Expands Phishing and Malware Operations in South Asia

APT SideWinder has launched a new targeted operation dubbed Operation SouthNet, focusing on the maritime sector in South Asia, particularly Pakistan and Sri Lanka. The group leverages free hosting platforms to deploy credential-harvesting portals and weaponized lure documents, while staging malware in open directories. Over 50 malicious domains were uncovered across various platforms, with Pakistan accounting for 40% of the identified domains. The campaign utilizes maritime and port-themed lures to target government and military entities. SideWinder's infrastructure overlaps with legacy C2 assets, indicating recycling across multiple years. The group maintains a high operational tempo, with new phishing domains emerging every 3-5 days.

• Critical infrastructure orgs face heightened cyber risk from nation-state groups, AI threatsCampaign2026-10-13
• Stray Cat, Open Doors: How k0t Wanders Through the Network EdgeCampaign2026-10-21
• Microsoft Teams to get AI-powered, context-aware phishing detectionNews2026-10-23
• Technology that blocks DGA domains | Kaspersky official blogAnalysis2026-10-23
• In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS RansomwareAnalysis2026-10-23