Microsoft Word - Global Perspective of the SideWinder APT (pre-release final).docx

AT&T Alien Labs presents a comprehensive analysis of the SideWinder APT, detailing multi-year targeted campaigns across South and East Asia that use spearphishing, weaponized RTF (CVE-2017-11882), HTA downloaders, DLL side‑loading and in‑memory implants to collect and exfiltrate files and system information; the report includes ATT&CK mappings, detection signatures (YARA, Suricata), and an extensive appendix of domains, hostnames and file hashes as IOCs for retrospective detection and remediation.