RagaSerpent SideWinder-Adjacent Tax Audit Cluster MultiCountry Targeted Chain.pdf

This ITSEC Asia Threat Intelligence report documents a multi-country, tax-themed spearphishing campaign (RagaSerpent / SideWinder–adjacent) active in 2025–2026 that delivers installer-style Windows payloads (ClientSetup.exe → MANC.exe), leverages third‑party SyncFuture tooling, establishes service-based persistence, and performs raw TCP C2 to hardcoded IPs; the report includes technical analysis, telemetry showing broad geographic and sectoral reach, extensive IOCs, MITRE ATT&CK mapping, and prioritized detection and mitigation guidance for government and telecom environments.