# APT SideWinder Domain Infrastructure Targeting South Asian Governments (CVE-2017-0199 Weaponized Documents)

> Embee Research tracked SideWinder (Razor Tiger / Rattlesnake / T-APT-04) infrastructure by pivoting on regex patterns, WHOIS data and NameSilo registrar overlap. The domains impersonate Pakistani government bodies, with Nepal, Sri Lanka and Bangladesh themes, and deliver weaponized Word documents that abuse CVE-2017-0199 remote template injection.

- **Published:** 2026-11-01T08:57:33Z
- **Last reviewed:** 2026-11-01T08:57:33Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4979
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-4979.png
- **ID:** TL-2026-4979
- **Severity:** HIGH (CVSS 7.8)
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Sidewinder - G0121 (India)
- **Detections:** 9 (1 shown free below) · **IOCs:** 27 (3 shown free below)
- **CVEs:** CVE-2017-0199

## Description

Embee Research (published 2024-05-23) started from the pivot domain mofa-services-server.top and its subdomain docs.mofa-services-server.top. It expanded the set with regex patterns for hyphenated three-word .top domains, Pakistan keywords (nitb|pk|pakistan), government themes (gov|govt|goverment|moma) and gov-pk/govpk naming. It then used WHOIS enrichment and passive DNS (SilentPush as the primary platform, with VirusTotal, Hybrid-Analysis and CyberChef) to find a bulk registration batch at NameSilo on 2024-03-19 between 04:09 and 04:11 UTC. The parent domain was first seen on 91.195.240.123 on 2024-03-20, and docs.mofa-services-server.top became active around 2024-05-01.

The infrastructure impersonates Pakistani entities including MOFA, NITB, MOMA, MOD, MOHRE, ECP, CTD, LGCD, PUBAD, NADRA, PTA, Pakistan Navy and DGPS. Wildcard-style subdomains under govt-pk.com mimic Nepali (.gov.np), Sri Lankan (.gov.lk) and Bangladeshi (.gov.bd) ministry domains, which shows regional expansion. The article lists Pakistan, Nepal and Sri Lanka as targets in places and also Bangladesh. It gives both 37 and 47 as the domain count, so figures should be treated with caution.

Initial access uses weaponized .docx files that exploit CVE-2017-0199. The document fetches a remote file.rtf through template injection, and the RTF delivers obfuscated JavaScript. One sample is MoITT_federalemp.docx (SHA-256 7dca552b..., first seen 2024-04-29, linked to paknavy-govpk.info). A second sample is tied to pmo.documents-server-pk.top. Embee also observed a newer delivery method: password-protected .zip archives (example password pmo@letter). The article names no malware family.

Attribution to SideWinder rests on heavy use of government-impersonating domains aimed at South Asian countries bordering India, the CVE-2017-0199 pattern matching public SideWinder reporting, government-themed .docx lures, hyphenated acronym naming, NameSilo overlap with known SideWinder infrastructure, and regional targeting. The source rates this high confidence. This record rates attribution MEDIUM because it is a single-source infrastructure-pivot attribution. The article also cites BlackBerry and Group-IB reporting on Pakistan Navy War College themed lures.

Corroborating later reporting: Acronis TRU (2025-05-20) describes a SideWinder campaign against Bangladesh, Pakistan and Sri Lanka institutions that chains CVE-2017-0199 and CVE-2017-11882 RTF/document exploits, shellcode with sandbox checks (RAM size, dotnetlogger32.dll), DLL side-loading (TapiUnattend.exe loading malicious wdscore.dll) and the StealerBot final payload. That reporting is separate from the Embee article and is included as context, not as proof the 2024 infrastructure delivered StealerBot. CVE-2017-0199 (NVD CVSS 3.1 7.8 HIGH; published 2017-04-12) is in the CISA KEV catalog, added 2021-11-03. The Embee article is the only source for the 2024 domain set, so whether it is still active is unconfirmed.

## MITRE ATT&CK

- T1583.001 Domains
- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1203 Exploitation for Client Execution
- T1059.007 JavaScript
- T1221 Template Injection
- T1027 Obfuscated Files or Information
- T1497.001 System Checks
- T1574.001 DLL

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SideWinder CVE-2017-0199 Office Template Fetch from Government-Themed Infrastructure — Exploitation** (`TL-2026-4979-SPL-001`)

Detects Word, WordPad or Excel resolving or connecting to SideWinder (G0121) infrastructure such as mofa-services-server.top, paknavy-govpk.info or 91.195.240.123, the remote template injection step of CVE-2017-0199 weaponized documents like MoITT_federalemp.docx. Also matches gov-pk, govpk and govt-pk lookalike names.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1221, T1203, T1566.001
- **Data sources:** sysmon, dns
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=22 OR EventCode=3) (Image="*\\WINWORD.EXE" OR Image="*\\wordpad.exe" OR Image="*\\EXCEL.EXE")
```CVE-2017-0199 remote template injection - Office or WordPad resolving or connecting to SideWinder infrastructure```
| eval target=lower(coalesce(QueryName, DestinationHostname, DestinationIp))
| where match(target, "(^|[.])(mofa-services-server[.]top|nitb-update-services[.]top|documents-server-pk[.]top|cabinet-download-server[.]top|services-pk-users[.]top|goverment-pk-update[.]top|luxury-get-away[.]top|paknavy-govpk[.]info|paknavy-govpk[.]com|dgps-govpk[.]co|govt-pk[.]com|nadra-govpk[.]com|pta-govpk[.]com|pakistan-mofa[.]cloud|army-govbd[.]info|ecility[.]xyz)$") OR DestinationIp="91.195.240.123" OR match(target, "(govpk|gov-pk|govt-pk|goverment-pk)[a-z0-9-]*[.][a-z]{2,6}$")
| stats count min(_time) as first_seen max(_time) as last_seen values(target) as remote_targets by Computer, User, Image, EventCode
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
let OfficeProcs = dynamic(["winword.exe","wordpad.exe","excel.exe"]);
let SideWinderDomains = dynamic(["mofa-services-server.top", "nitb-update-services.top", "documents-server-pk.top", "cabinet-download-server.top", "services-pk-users.top", "goverment-pk-update.top", "luxury-get-away.top", "paknavy-govpk.info", "paknavy-govpk.com", "dgps-govpk.co", "govt-pk.com", "nadra-govpk.com", "pta-govpk.com", "pakistan-mofa.cloud", "army-govbd.info", "ecility.xyz"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ (OfficeProcs)
| where RemoteIP == "91.195.240.123" or RemoteUrl has_any (SideWinderDomains) or tolower(RemoteUrl) matches regex @"(govpk|gov-pk|govt-pk|goverment-pk)"
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
| order by Timestamp desc
```

### Sigma

```yaml
title: SideWinder CVE-2017-0199 Office Template Fetch from Government-Themed Infrastructure
id: 3f6a1c52-8d47-4b19-9e2a-5c7d0b41a601
status: experimental
description: Detects Word, WordPad or Excel resolving SideWinder (G0121) infrastructure such as mofa-services-server.top or paknavy-govpk.info during CVE-2017-0199 remote template injection
references:
    - https://www.embeeresearch.io/advanced-guide-to-infrastructure-analysis-tracking-apt-sidewinder-domains/
    - https://nvd.nist.gov/vuln/detail/CVE-2017-0199
    - https://www.acronis.com/en/tru/posts/from-banks-to-battalions-sidewinders-attacks-on-south-asias-public-sector/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/01
tags:
    - attack.initial-access
    - attack.t1566.001
    - attack.defense-evasion
    - attack.t1221
    - attack.execution
    - attack.t1203
    - attack.g0121
    - cve.2017-0199
logsource:
    category: dns_query
    product: windows
detection:
    office:
        Image|endswith:
            - '\WINWORD.EXE'
            - '\wordpad.exe'
            - '\EXCEL.EXE'
    domains:
        QueryName|endswith:
            - 'mofa-services-server.top'
            - 'nitb-update-services.top'
            - 'documents-server-pk.top'
            - 'cabinet-download-server.top'
            - 'services-pk-users.top'
            - 'goverment-pk-update.top'
            - 'luxury-get-away.top'
            - 'paknavy-govpk.info'
            - 'paknavy-govpk.com'
            - 'dgps-govpk.co'
            - 'govt-pk.com'
            - 'nadra-govpk.com'
            - 'pta-govpk.com'
            - 'pakistan-mofa.cloud'
            - 'army-govbd.info'
            - 'ecility.xyz'
    govpattern:
        QueryName|re: '(govpk|gov-pk|govt-pk|goverment-pk)[a-z0-9-]*[.][a-z]{2,6}$'
    condition: office and (domains or govpattern)
falsepositives:
    - Security researchers or sandbox hosts intentionally browsing the listed domains from Office
    - Internal red-team phishing simulations reusing government-themed domains
level: high

```

**Known false positives:**

- Security researchers or sandbox hosts intentionally opening the lure documents
- Internal phishing simulations reusing government-themed domains

**Tuning notes:** Requires Sysmon EventCode 22 (DNS) and 3 (network) with Image logging. Enrol new domains from the pivot set as they appear, exclude analyst sandbox hosts, and leave 188.114.97.3 (shared Cloudflare IP) out of any IP rule. The 2024 domain set may be inactive, so keep the lookalike regex enabled.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SideWinder Password-Protected Zip Lure Opened in Word or WordPad — Exploitation (locked: unlock with TL Creds)
- SideWinder TapiUnattend.exe Side-Loading [indicator] — Post-Exploitation (locked: unlock with TL Creds)
- SideWinder Government-Impersonation Lookalike Domain Pattern — Infrastructure (locked: unlock with TL Creds)
- SideWinder Office RTF or Script Payload Written to INetCache or Temp — Exploitation (locked: unlock with TL Creds)
- SideWinder Script Host Execution from User-Writable Paths or Remote HTA — Post-Exploitation (locked: unlock with TL Creds)
- SideWinder Known Weaponized Document [indicator] — Delivery (locked: unlock with TL Creds)
- SideWinder Office Child Process Script and LOLBin Execution — Post-Exploitation (locked: unlock with TL Creds)
- SideWinder Infrastructure DNS and Network Contact — C2 and Delivery (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 27)

Defanged, TLP:CLEAR.

- IP address: `91.195.240[.]123`
- Domain: `mofa-services-server[.]top`
- File hash: `7dca552bc38f54716c80eb2c4f1f35cf6e5b12a78a5cec8bf335453c1b433cfd`

Full set of 27 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Tracking APT SideWinder Domains By Combining Regex Patterns, Whois Records and Domain Registrars](https://www.embeeresearch.io/advanced-guide-to-infrastructure-analysis-tracking-apt-sidewinder-domains/)
- [NVD - CVE-2017-0199](https://nvd.nist.gov/vuln/detail/CVE-2017-0199)
- [Microsoft Security Advisory CVE-2017-0199](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [From Banks to Battalions: SideWinder's Attacks on South Asia's Public Sector (Acronis TRU)](https://www.acronis.com/en/tru/posts/from-banks-to-battalions-sidewinders-attacks-on-south-asias-public-sector/)
- [South Asian Ministries Hit by SideWinder (The Hacker News)](https://thehackernews.com/2025/05/south-asian-ministries-hit-by.html)
- [SideWinder Launches New Espionage Campaign on Ports (GovInfoSecurity)](https://www.govinfosecurity.com/sidewinder-launches-new-espionage-campaign-on-ports-a-25896)
- [SideWinder Spear-Phishing Campaign Against Bangladesh Leveraging Dual-Format Weaponized Documents (BGD e-GOV CIRT)](https://cirt.gov.bd/advisories/sidewinder-spear-campaign)
- [SideWinder APT Targets Pakistan Using Government Themed Domains - Active IOCs (Rewterz)](https://rewterz.com/threat-advisory/sidewinder-apt-targets-pakistan-using-government-themed-domains-active-iocs)
- [SideWinder APT Spying on India's Neighbor Govts (Dark Reading)](https://www.darkreading.com/cyberattacks-data-breaches/sidewinder-apt-spying-indias-neighbor-govts)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4979