The Qi Anxin Threat Intelligence Center analyzed SideWinder (APT-Q-39) samples from Google Play that were installed mainly in South Asia and have over 1k installs (English via Google Translate). Especially the concealment of the C2 address in the installation link parameters seems interesting. Two weeks earlier, Group-IB had flagged a suspected SideWinder app on Google Play, “SecureVPN” with a listing copied from NordVPN and 10+ downloads, reached through phishing links that a custom SideWinder.AntiBot.Script only served to visitors from Pakistan. BleepingComputer adds that Google removed the app along with five other SideWinder-linked apps found by Avast researcher Nikolaos Chrysaidos.
