#APT #Sidewinder targets #Myanmar Central Bank
1/
Using @Huntio, I have tracked a new operational Fake Zimbra page "https://mailcbmgovmm[.]pages[.]dev/index1" which exfiltrate info to "myanmar-org-mail[.]com/cbm/action1[.]php/".
@500mk500 @MichalKoczwara @malwrhunterteam
Nov 8, 2025 · 4:56 AM UTC
2/
Research on #Operation #SouthNet by @Huntio also revealed that same pages was observed at https://mailcbmgovmm[.]pages[.]dev which is now reported as phishing.
3/
However, the #sidewinder still using the same domain and C2 server to continue phishing.
ref: hunt.io/blog/operation-south…
