APT SideWinder Domain Infrastructure Targeting South Asian Governments (CVE-2017-0199 Weaponized Documents)

Key facts for SideWinder CVE-2017-0199 lures

Detection coverage for SideWinder CVE-2017-0199 lures

As of 2026-11-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4979 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SideWinder CVE-2017-0199 Office Template Fetch from Government-Themed Infrastructure — Exploitation

Detects Word, WordPad or Excel resolving or connecting to SideWinder (G0121) infrastructure such as mofa-services-server.top, paknavy-govpk.info or 91.195.240.123, the remote template injection step of CVE-2017-0199 weaponized documents like MoITT_federalemp.docx. Also matches gov-pk, govpk and govt-pk lookalike names.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1221, T1203, T1566.001
• Data sources: sysmon, dns
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=22 OR EventCode=3) (Image="*\\WINWORD.EXE" OR Image="*\\wordpad.exe" OR Image="*\\EXCEL.EXE")
```CVE-2017-0199 remote template injection - Office or WordPad resolving or connecting to SideWinder infrastructure```
| eval target=lower(coalesce(QueryName, DestinationHostname, DestinationIp))
| where match(target, "(^|[.])(mofa-services-server[.]top|nitb-update-services[.]top|documents-server-pk[.]top|cabinet-download-server[.]top|services-pk-users[.]top|goverment-pk-update[.]top|luxury-get-away[.]top|paknavy-govpk[.]info|paknavy-govpk[.]com|dgps-govpk[.]co|govt-pk[.]com|nadra-govpk[.]com|pta-govpk[.]com|pakistan-mofa[.]cloud|army-govbd[.]info|ecility[.]xyz)$") OR DestinationIp="91.195.240.123" OR match(target, "(govpk|gov-pk|govt-pk|goverment-pk)[a-z0-9-]*[.][a-z]{2,6}$")
| stats count min(_time) as first_seen max(_time) as last_seen values(target) as remote_targets by Computer, User, Image, EventCode
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let OfficeProcs = dynamic(["winword.exe","wordpad.exe","excel.exe"]);
let SideWinderDomains = dynamic(["mofa-services-server.top", "nitb-update-services.top", "documents-server-pk.top", "cabinet-download-server.top", "services-pk-users.top", "goverment-pk-update.top", "luxury-get-away.top", "paknavy-govpk.info", "paknavy-govpk.com", "dgps-govpk.co", "govt-pk.com", "nadra-govpk.com", "pta-govpk.com", "pakistan-mofa.cloud", "army-govbd.info", "ecility.xyz"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ (OfficeProcs)
| where RemoteIP == "91.195.240.123" or RemoteUrl has_any (SideWinderDomains) or tolower(RemoteUrl) matches regex @"(govpk|gov-pk|govt-pk|goverment-pk)"
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
| order by Timestamp desc

Sigma

title: SideWinder CVE-2017-0199 Office Template Fetch from Government-Themed Infrastructure
id: 3f6a1c52-8d47-4b19-9e2a-5c7d0b41a601
status: experimental
description: Detects Word, WordPad or Excel resolving SideWinder (G0121) infrastructure such as mofa-services-server.top or paknavy-govpk.info during CVE-2017-0199 remote template injection
references:
    - https://www.embeeresearch.io/advanced-guide-to-infrastructure-analysis-tracking-apt-sidewinder-domains/
    - https://nvd.nist.gov/vuln/detail/CVE-2017-0199
    - https://www.acronis.com/en/tru/posts/from-banks-to-battalions-sidewinders-attacks-on-south-asias-public-sector/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/01
tags:
    - attack.initial-access
    - attack.t1566.001
    - attack.defense-evasion
    - attack.t1221
    - attack.execution
    - attack.t1203
    - attack.g0121
    - cve.2017-0199
logsource:
    category: dns_query
    product: windows
detection:
    office:
        Image|endswith:
            - '\WINWORD.EXE'
            - '\wordpad.exe'
            - '\EXCEL.EXE'
    domains:
        QueryName|endswith:
            - 'mofa-services-server.top'
            - 'nitb-update-services.top'
            - 'documents-server-pk.top'
            - 'cabinet-download-server.top'
            - 'services-pk-users.top'
            - 'goverment-pk-update.top'
            - 'luxury-get-away.top'
            - 'paknavy-govpk.info'
            - 'paknavy-govpk.com'
            - 'dgps-govpk.co'
            - 'govt-pk.com'
            - 'nadra-govpk.com'
            - 'pta-govpk.com'
            - 'pakistan-mofa.cloud'
            - 'army-govbd.info'
            - 'ecility.xyz'
    govpattern:
        QueryName|re: '(govpk|gov-pk|govt-pk|goverment-pk)[a-z0-9-]*[.][a-z]{2,6}$'
    condition: office and (domains or govpattern)
falsepositives:
    - Security researchers or sandbox hosts intentionally browsing the listed domains from Office
    - Internal red-team phishing simulations reusing government-themed domains
level: high

Known false positives:

• Security researchers or sandbox hosts intentionally opening the lure documents
• Internal phishing simulations reusing government-themed domains

Tuning notes: Requires Sysmon EventCode 22 (DNS) and 3 (network) with Image logging. Enrol new domains from the pivot set as they appear, exclude analyst sandbox hosts, and leave 188.114.97.3 (shared Cloudflare IP) out of any IP rule. The 2024 domain set may be inactive, so keep the lookalike regex enabled.

• 🔒 SideWinder Password-Protected Zip Lure Opened in Word or WordPad — Exploitation · unlock with TL Creds
• 🔒 SideWinder TapiUnattend.exe Side-Loading [indicator] — Post-Exploitation · unlock with TL Creds
• 🔒 SideWinder Government-Impersonation Lookalike Domain Pattern — Infrastructure · unlock with TL Creds
• 🔒 SideWinder Office RTF or Script Payload Written to INetCache or Temp — Exploitation · unlock with TL Creds
• 🔒 SideWinder Script Host Execution from User-Writable Paths or Remote HTA — Post-Exploitation · unlock with TL Creds
• 🔒 SideWinder Known Weaponized Document [indicator] — Delivery · unlock with TL Creds
• 🔒 SideWinder Office Child Process Script and LOLBin Execution — Post-Exploitation · unlock with TL Creds
• 🔒 SideWinder Infrastructure DNS and Network Contact — C2 and Delivery · unlock with TL Creds

Indicators of compromise for SideWinder CVE-2017-0199 lures

As of 2026-11-01, Threadlinqs Intelligence tracks 27 indicators of compromise for TL-2026-4979.

Sample indicators (3 of 27)

• IP address: 91.195.240[.]123
• Domain: mofa-services-server[.]top
• File hash: 7dca552bc38f54716c80eb2c4f1f35cf6e5b12a78a5cec8bf335453c1b433cfd

Defanged, TLP:CLEAR. Full set of 27 indicators: unlock with TL Creds.

Community OSINT corroboration for SideWinder CVE-2017-0199 lures

1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How SideWinder CVE-2017-0199 lures works

Embee Research (published 2024-05-23) started from the pivot domain mofa-services-server.top and its subdomain docs.mofa-services-server.top. It expanded the set with regex patterns for hyphenated three-word .top domains, Pakistan keywords (nitb|pk|pakistan), government themes (gov|govt|goverment|moma) and gov-pk/govpk naming. It then used WHOIS enrichment and passive DNS (SilentPush as the primary platform, with VirusTotal, Hybrid-Analysis and CyberChef) to find a bulk registration batch at NameSilo on 2024-03-19 between 04:09 and 04:11 UTC. The parent domain was first seen on 91.195.240.123 on 2024-03-20, and docs.mofa-services-server.top became active around 2024-05-01.

The infrastructure impersonates Pakistani entities including MOFA, NITB, MOMA, MOD, MOHRE, ECP, CTD, LGCD, PUBAD, NADRA, PTA, Pakistan Navy and DGPS. Wildcard-style subdomains under govt-pk.com mimic Nepali (.gov.np), Sri Lankan (.gov.lk) and Bangladeshi (.gov.bd) ministry domains, which shows regional expansion. The article lists Pakistan, Nepal and Sri Lanka as targets in places and also Bangladesh. It gives both 37 and 47 as the domain count, so figures should be treated with caution.

Initial access uses weaponized .docx files that exploit CVE-2017-0199. The document fetches a remote file.rtf through template injection, and the RTF delivers obfuscated JavaScript. One sample is MoITT_federalemp.docx (SHA-256 7dca552b..., first seen 2024-04-29, linked to paknavy-govpk.info). A second sample is tied to pmo.documents-server-pk.top. Embee also observed a newer delivery method: password-protected .zip archives (example password pmo@letter). The article names no malware family.

Attribution to SideWinder rests on heavy use of government-impersonating domains aimed at South Asian countries bordering India, the CVE-2017-0199 pattern matching public SideWinder reporting, government-themed .docx lures, hyphenated acronym naming, NameSilo overlap with known SideWinder infrastructure, and regional targeting. The source rates this high confidence. This record rates attribution MEDIUM because it is a single-source infrastructure-pivot attribution. The article also cites BlackBerry and Group-IB reporting on Pakistan Navy War College themed lures.

Corroborating later reporting: Acronis TRU (2025-05-20) describes a SideWinder campaign against Bangladesh, Pakistan and Sri Lanka institutions that chains CVE-2017-0199 and CVE-2017-11882 RTF/document exploits, shellcode with sandbox checks (RAM size, dotnetlogger32.dll), DLL side-loading (TapiUnattend.exe loading malicious wdscore.dll) and the StealerBot final payload. That reporting is separate from the Embee article and is included as context, not as proof the 2024 infrastructure delivered StealerBot. CVE-2017-0199 (NVD CVSS 3.1 7.8 HIGH; published 2017-04-12) is in the CISA KEV catalog, added 2021-11-03. The Embee article is the only source for the 2024 domain set, so whether it is still active is unconfirmed.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1221 Template Injection; T1497.001 System Checks; T1574.001 DLL

Execution

T1059.007 JavaScript; T1203 Exploitation for Client Execution; T1204.002 Malicious File

Initial Access

T1566.001 Spearphishing Attachment

Resource Development

T1583.001 Domains

Remediation for SideWinder CVE-2017-0199 lures

Patches

• Apply Microsoft security update for CVE-2017-0199 per MSRC advisory (CISA KEV required action: apply updates per vendor instructions)

Immediate actions

• Block and sinkhole the listed domains and IP addresses at DNS, proxy and perimeter, and search historical DNS and proxy logs for them
• Hunt for Office/WordPad processes (winword.exe, wordpad.exe) fetching remote .rtf or .dotm templates from external hosts
• Quarantine and review inbound password-protected .zip attachments with government-themed lures

Workarounds

• Block external template loading and RTF/Office documents from untrusted sources via Protected View and Attack Surface Reduction rules
• Disable WordPad and legacy Office versions where unneeded

Longer-term hardening

• Monitor newly registered domains matching government-impersonation patterns such as gov-pk, govpk, govt-pk and nitb/pk keywords
• Alert on bulk NameSilo registrations of lookalike domains
• Deploy EDR with behavioral detection for Office child-process and script execution

Affected and fixed versions

• Microsoft — Office
  Vulnerable versions: 2007 SP3; 2010 SP2; 2013 SP1; 2016
  Fixed in: Microsoft April 2017 security updates
• Microsoft — Windows (WordPad)
  Vulnerable versions: Vista SP2; 7 SP1; Server 2008 SP2; Server 2012
  Fixed in: Microsoft April 2017 security updates
• Philips — IntelliSpace Portal
  Vulnerable versions: 7.0; 8.0

Timeline of SideWinder CVE-2017-0199 lures

• 2017-04-12 CVE-2017-0199 (Office/WordPad remote template injection RCE) published in NVD; CVSS 3.1 7.8 HIGH
• 2021-11-03 CISA adds CVE-2017-0199 to the Known Exploited Vulnerabilities catalog (due date 2022-05-03)
• 2024-03-19 Bulk batch of SideWinder-linked domains registered at locked-ioc-27 between 04:09 and 04:11 UTC
• 2024-03-20 Parent domain locked-ioc-7 first observed resolving to locked-ioc-19
• 2024-04-29 Weaponized document locked-ioc-12 first seen, linked to locked-ioc-15
• 2024-05-01 Subdomain locked-ioc-4 became active, about six weeks after registration
• 2024-05-23 Embee Research publishes infrastructure analysis attributing the domain cluster to SideWinder with high confidence
• 2025-05-20 Acronis TRU publishes a later SideWinder campaign against Bangladesh, Pakistan and Sri Lanka using CVE-2017-0199/CVE-2017-11882 lures and locked-ioc-26

Sources cited for SideWinder CVE-2017-0199 lures

• NVD - CVE-2017-0199 NVD (NIST) · Advisory · 2017-04-12
• CISA Known Exploited Vulnerabilities Catalog CISA · Government advisory · 2021-11-03
• SideWinder Spear-Phishing Campaign Against Bangladesh Leveraging Dual-Format Weaponized Documents (BGD e-GOV CIRT) cirt.gov.bd · Advisory
• Tracking APT SideWinder Domains By Combining Regex Patterns, Whois Records and Domain Registrars embeeresearch.io · Research · 2024-05-23
• Microsoft Security Advisory CVE-2017-0199 Microsoft Security Response Center · Vendor report · 2017-04-11
• From Banks to Battalions: SideWinder's Attacks on South Asia's Public Sector (Acronis TRU) acronis.com · Research · 2025-05-20
• SideWinder APT Targets Pakistan Using Government Themed Domains - Active IOCs (Rewterz) rewterz.com · Blog
• South Asian Ministries Hit by SideWinder (The Hacker News) The Hacker News · News
• SideWinder Launches New Espionage Campaign on Ports (GovInfoSecurity) govinfosecurity.com · News
• SideWinder APT Spying on India's Neighbor Govts (Dark Reading) Dark Reading · News

More in apt

• ARTEX Autonomous AI Pentest Framework Weaponized by UNC7228 / Storm-0940 for Automated Network Intrusions, Cloud Abuse and Data Theft
• Suspected APT37 Python Backdoor Delivered via AI Deepfake Impersonation Spear-Phishing Campaign
• MuddyWater APT (MOIS-affiliated) Multi-Year Campaigns Targeting the Middle East and Global Organizations
• CISA AA26-194A: Russian State-Sponsored (FSB Center 16) Exploitation of Misconfigured Cisco Routers via SNMP and Smart Install (CVE-2018-0171, CVE-2008-4128)
• APT and Financial Attacks on Industrial Organizations in Q1 2026 (Kaspersky ICS CERT): Operation Neusploit (CVE-2026-21509/CVE-2026-21513), Poland Energy Wipers, TGR-STA-1030, MuddyWater, LockBit 5.0, Diesel Vortex