Analysis Links Pension-Themed Spear-Phishing Implant to Regional Campaign, but SideWinder Attribution Remains Unproven
Summary
A password-protected pension-themed Word attachment concealed DellHeuristics.exe, whose lab activity used GitHub APIs. Its embedded IP matched an earlier regional phishing IOC, but a SideWinder link remains unproven.
Key points
- A September 2025 government-themed email used a password-protected Word attachment to target selected public-sector recipients; available evidence does not establish who opened or ran it.
- The document embedded DellHeuristics.exe and contained VBA and VBS/BAT logic intended to place the payload in a user-writable directory and establish Startup-folder and scheduled-task persistence; completion on a victim device was not confirmed.
- In lab execution, the implant queried ip-api[.]com and retrieved bootstrap data from raw.githubusercontent[.]com, then read a marker through the GitHub API.
- The original code required a Myanmar country-code result to continue. The instrumented run proceeded only after an analyst changed that check, so later observations were analyst-modified.
- One run attempted an authenticated GitHub API write, but success was not established. A separate instrumented run constructed an empty-content PUT and verification GET that were bypassed before transmission.
- The embedded IP 88.119.161[.]40 exactly matched an IOC in an August 2025 Bangladesh e-GOV CIRT phishing report; this overlap does not establish common operators.
- Regional reporting makes SideWinder a lead for further investigation, not a proven attribution. The article recommends correlating email, endpoint, persistence, and network telemetry.
Article Details
- Attack Vectors
- A pension-themed spear-phishing email dated 2025-09-15 targeted a selected public-sector audience with a password-protected malicious Word attachment. The password was supplied in the message.
- The document's VBA reconstructed an embedded ZIP from decimal-encoded data. The recovered archive contained DellHeuristics.exe, so initial payload delivery did not depend on a subsequent download.
- Code-derived VBS/BAT staging placed the executable in a user-writable directory and attempted persistence through a Startup-folder launcher and a scheduled task with a five-minute trigger. Production execution was not established.
- The document referenced a government-lookalike hostname for an external image and macro callback.
- The executable used public-network geolocation and a Myanmar country-code execution gate before a GitHub-backed bootstrap and repository check-in workflow.
- Runtime evidence established GitHub content retrieval and an attempted authenticated repository write in one process. A second, analyst-modified run constructed an empty-file check-in and verification request, but both requests were bypassed before transmission. Successful exfiltration and operator command execution were not established.
- Defensive Notes
- Where policy permits, inspect encrypted Office attachments using passwords supplied in the same message, preserve original EML evidence, and verify apparent government senders through an independent channel.
- Correlate Office child processes with script-host execution, VBS/BAT creation in user-writable directories, and subsequent executable launches.
- Hunt for DellHeuristicsUpdate tasks with five-minute triggers and newly created Startup-folder VBS launchers; validate creation times, executable paths, and adjacent file events.
- Review public-network lookup followed by raw GitHub retrieval and GitHub Contents API access by uncommon native executables. Correlate process lineage and exact resource paths rather than blocking GitHub globally.
- Prioritize contemporaneous September 2025 email, endpoint, DNS, proxy, firewall, and Task Scheduler records. September 2026 laboratory behavior cannot establish historical delivery, execution, or infrastructure responses.
- Distinguish API entry observations from successful HTTP responses and remote effects. Repository write success requires response status, response content, or authorized repository audit evidence.
- Treat the shared IP as an investigation pivot, not proof of common operators. Direct SideWinder attribution requires additional malware-lineage or uniquely shared infrastructure evidence.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | edmsvpn[.]gov[.]en-mm[.]com | Government-lookalike hostname referenced by the malicious document for an external image and macro callback. |
| IPV4 | 88[.]119[.]161[.]40 | Fallback network indicator embedded in the executable and an exact match to an IOC in the August 2025 Bangladesh e-GOV CIRT phishing advisory. Contact with this address was not established in the captured run. |
| SHA256 | 61d2fb525da40827d54066aedceb0489dc44aef694ca925a1b120d0a9cf4dc65 | SHA-256 of SpearPhising.eml, the retained spear-phishing email delivering the malicious attachment. |
| SHA256 | cbbe346b679871b3a70b0493dc52565280211b3354f480dc0c02abcfb862af87 | SHA-256 of DellHeuristics.exe, the implant reconstructed from the document's embedded ZIP and examined in two runtime instances. |
| SHA256 | eadd9f97166b59a02d9c25cd2ff721ed06b7c28050aa08db3fe80b97acbb80ba | SHA-256 of dop0035-2025.doc, the password-protected malicious attachment containing the embedded executable and deployment logic. |
| URL | hxxps[:]//api[.]github[.]com/repos/faviconicons2/images/contents/License | Specific GitHub API resource used by the implant to retrieve the Readme9823 enable marker. |
| URL | hxxps[:]//api[.]github[.]com/repos/faviconicons2/images/contents/qKPJHGWmla3GrHhx/.txt | Per-run GitHub API resource constructed for an empty-file PUT and verification GET in the analyst-modified PID 1608 run. Both sends were bypassed before transmission. |
| URL | hxxps[:]//api[.]github[.]com/repos/faviconicons2/images/contents/S3wfQWRnRraKMhvC/.txt | Per-run GitHub API check-in resource targeted by an authenticated PUT in PID 452. The send and receive stages were reached, but remote write success was not established. |
| URL | hxxps[:]//raw[.]githubusercontent[.]com/drivelogo1/animatedtk/refs/heads/main/logotk2 | Specific GitHub-hosted bootstrap resource used by the implant; runtime analysis observed a 65-byte response involved in recovering credential-shaped material. |
MITRE ATT&CK
T1016.001 · Internet Connection DiscoveryThe executable queried ip-api[.]com/json for public-network information, and the laboratory observed a returned geolocation response.T1027.009 · Embedded PayloadsThe macro project concealed a ZIP archive as 507,077 decimal characters; reconstruction recovered DellHeuristics.exe.T1053.005 · Scheduled TaskCode-derived persistence logic configured DellHeuristicsUpdate to run on a five-minute interval.T1059.003 · Windows Command ShellRecovered BAT staging formed part of the intended document-to-executable launch chain.T1059.005 · Visual BasicRecovered VBA and VBS logic reconstructed the embedded archive and staged the executable; the complete document-driven chain was not dynamically replayed.T1071.001 · Web ProtocolsWinHTTP observations showed HTTP/S requests for geolocation, raw GitHub bootstrap content, and authenticated GitHub Contents API operations.T1102 · Web ServiceThe implant used specific GitHub resources for bootstrap data, an enable marker, and an attempted repository check-in rather than relying solely on dedicated infrastructure.T1204.002 · Malicious FileThe intended delivery chain required a recipient to open the malicious document and permit active content; recipient execution was not observed.T1547.001 · Registry Run Keys / Startup FolderRecovered scripts specified a VBS launcher in the current user's Startup folder; successful persistence on a victim endpoint was not established.T1566.001 · Spearphishing AttachmentThe retained email delivered a pension-themed, password-protected malicious Word attachment to selected institutional recipients.T1614 · System Location DiscoveryThe executable compared the external geolocation countryCode with MM and exited when the laboratory response reported MY. Later PID 1608 behavior followed an analyst patch to that comparison.
CVE
Threat Actors
Malware
Vendors
Products
GitHubIt used familiar public services—including GitHub—in a sequence that could blend into normal web traffic.Microsoft OfficeDepending on the version of Microsoft Office and the organization's security policy, a recipient might also encounter Protected View, an external-content notice, or a prompt related to active content.Microsoft WindowsWhen reconstructed, the archive revealed a Windows program named DellHeuristics.exe.Wordthe password-protected Word attachment and its embedded content;
Tools
Countries
BangladeshOne IP address embedded in the program, 88.119.161[.]40, had already been published by Bangladesh e-GOV CIRT in August 2025 as an indicator connected to a government-targeting phishing campaign.MyanmarSubsequent reporting on Operation SouthNet and SideWinder described similar regional targeting, government-themed lures, and abuse of trusted online infrastructure across South Asia, including Myanmar.Nepala regional cluster to SideWinder and documented phishing and malware activity across Bangladesh, Nepal, Myanmar, Pakistan, and Sri Lanka; government, defense, maritime, and critical-sector targeting; politicalPakistancluster to SideWinder and documented phishing and malware activity across Bangladesh, Nepal, Myanmar, Pakistan, and Sri Lanka; government, defense, maritime, and critical-sector targeting; political andSri Lankaand documented phishing and malware activity across Bangladesh, Nepal, Myanmar, Pakistan, and Sri Lanka; government, defense, maritime, and critical-sector targeting; political and administrative lure
Industries
Defensephishing and malware activity across Bangladesh, Nepal, Myanmar, Pakistan, and Sri Lanka; government, defense, maritime, and critical-sector targeting; political and administrative lure documents; abuse of trustedDiplomaticIt assesses sustained targeting of government, defence, and diplomatic organizations across Bangladesh, Sri Lanka, Nepal, and Pakistan, while also connecting the activity to earlier 2024–2025 operations and Hunt.io'sGovernmentIt looked like an ordinary administrative email: a notice about changes to pension rules, apparently sent from a trusted government address.Maritimeand malware activity across Bangladesh, Nepal, Myanmar, Pakistan, and Sri Lanka; government, defense, maritime, and critical-sector targeting; political and administrative lure documents; abuse of trusted public