Kaspersky researchers have tracked a shift in focus for the infamous advanced persistent threat (APT) group SideWinder toward nuclear power facilities in South Asia, marking a significant escalation in targeted espionage. The threat actor has simultaneously expanded operations across Africa, Southeast Asia and parts of Europe.
Kaspersky’s Global
Research and Analysis Team (GReAT) has documented a concerning two-pronged
threat from the SideWinder APT group, which now shows a heightened focus on
nuclear power plants and energy facilities across South Asia. This nuclear
pivot runs parallel to the group’s geographic expansion beyond its conventional
arenas.
Active since at least
2012, SideWinder has historically targeted government, military and diplomatic
entities. The group has broadened its victim profile to include maritime
infrastructure and logistics companies throughout Southeast Asia, while setting
fresh sights on nuclear sector targets. Kaspersky researchers noted a spike in
attacks aimed at nuclear power agencies that use spear-phishing emails and
malicious documents laden with industry-specific terminology.
Tracking SideWinder
across 15 countries and three continents, Kaspersky observed numerous attacks
in Djibouti before the group shifted focus to Egypt and launched additional
operations in Mozambique, Austria, Bulgaria, Cambodia, Indonesia, the
Philippines and Vietnam. Diplomatic entities in Afghanistan, Algeria, Rwanda,
Saudi Arabia, Türkiye and Uganda have also been targeted, further illustrating
SideWinder’s move well beyond South Asia.
“What we’re witnessing is not
just a geographic expansion but a strategic evolution in SideWinder’s
capabilities and ambitions,” said Vasily Berdnikov, lead security researcher at
Kaspersky’s GReAT. “They can deploy updated
malware variants with remarkable speed after detection, which transforms the
threat landscape from reactive to nearly real-time combat.”
Despite relying on an
older Microsoft Office vulnerability (CVE-2017-11882), SideWinder leverages rapid
modifications to its toolset for evading detection. In targeting nuclear
infrastructure, the group crafts convincing spear-phishing emails that appear
to concern regulatory or plant-specific matters. Once opened, these documents
initiate an exploitation chain that can grant attackers access to nuclear
facilities’ operational data, research projects and personnel details.
Kaspersky protects
organizations from such attacks through multiple security layers, including
vulnerability management solutions, early-stage attack prevention, real-time
threat detection with automated response and continuously updated detection
rules aligned with SideWinder’s evolving malware.
The full technical
analysis of SideWinder's latest operations is available on Securelist.com.
To help organizations
protect their critical infrastructure against sophisticated targeted attacks,
Kaspersky security experts recommend the following measures:
- Implement
comprehensive patch management. Kaspersky Vulnerability Assessment and
Patch Management provides automated vulnerability detection and
patch distribution to eliminate security gaps in your infrastructure.
- Deploy multi-layered
security solutions with real-time threat detection capabilities. Kaspersky Next XDR Expert aggregates
and correlates data from multiple sources using machine-learning technologies
for effective threat detection and automated response to sophisticated attacks.
-
Conduct regular cybersecurity awareness training for
employees, with a special focus on recognizing sophisticated spear-phishing
attempts.
About the Global Research &
Analysis Team
Established in 2008,
Global Research & Analysis Team (GReAT) operates at the very heart of
Kaspersky, uncovering APTs, cyber-espionage campaigns, major malware,
ransomware and underground cyber-criminal trends across the world. Today GReAT
consists of 35+ experts working globally – in Europe, Russia, Latin America,
Asia and the Middle East. Talented security professionals provide company
leadership in anti-malware research and innovation, bringing unrivaled
expertise, passion and curiosity to the discovery and analysis of cyberthreats.
