India-Linked Threat Actors Utilized Telegram for Coordinating Cyberattacks in Asia

The cyber intelligence firm Group-IB has revealed a series of phishing attacks carried out by a suspected threat group with ties to Indian nationalists. The attacks targeted a range of government, military, and legal organizations throughout Asia, as reported by Group-IB.

The group behind the attacks, SideWinder aka Hardcore Nationalist (HN2), reportedly targeted more than 60 organizations in countries such as Afghanistan, Bhutan, Myanmar, Nepal, and Sri Lanka. Government agencies were the primary targets, with 44 being singled out, while only four attacks were aimed at military organizations. Almost half of the attacks were directed at targets in Nepal, which shares a border with India.

“The group has been carrying out cyber espionage attacks against government organizations in the Asia-Pacific region since at least 2012. In June 2022, Group-IB discovered the group’s newest custom tool, SideWinder.AntiBot.Script, which was used in previously documented phishing attacks against Pakistani organizations. SideWinder is notable for its ability to conduct hundreds of espionage operations within a short span of time,” said Group-IB researchers.

According to the cyber analysts, SideWinder utilized Telegram, a widely-used messaging app, to process data from the targeted systems. Telegram has gained popularity among Advanced Persistent Threat (APT) groups and financially-motivated cybercriminals as a command-and-control center or a base of operations, due to its user-friendly interface.

Group-IB reported that SideWinder has updated its toolkit and is now using two new tools:

• SideWinder.RAT.b — a remote access Trojan
• SideWinder.StealerPy — a custom information stealer designed to extract data from the victim’s computer.

The tool is capable of extracting a range of sensitive information from the victim’s computer. This includes Google Chrome browsing history, details of saved directories and folders, credentials saved in the browser, metadata, and contents of .txt, .docx, and .pdf files.

It remains unclear whether any of the phishing campaigns were successful. Notably, Group-IB analysts identified two phishing projects that imitated cryptocurrency companies. The increasing interest of SideWinder in cryptocurrency could be related to recent efforts to regulate the crypto market in India.