APT Sidewinder Abuses Netlify to Mimic Government and Military Portals in South Asia

Operation SouthNet: SideWinder shifted focus to South Asia's maritime sector, staging 50+ credential-harvesting domains on free hosting platforms and reusing legacy C2 across Pakistan and Sri Lanka.

Explores hosting red team phishing pages and payloads on Azure services under Microsoft's trusted domains, using their good reputation to slip past web filters as domain fronting fades.

Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.

Hunt.io traced five exposed directories to a SecFlow-run campaign that used Claude, Qwen and DeepSeek as workers against government, education and diplomatic targets across Asia.

This threat intelligence report documents active targeting of critical national infrastructure and defense contractors through edge application vulnerabilities.

Hunt.io correlates 28 multilingual phishing pages—Chinese, English and Japanese—sharing ZIP lures and download.php backend logic, targeting financial and government organizations across Asia.