BreakglassIntelligence
Back to reports
criticalAPT

SideWinder APT Credential Harvesting Campaign — PaaS Platform Abuse at Scale

InvestigatedApril 5, 2026PublishedApril 5, 2026
Threat Actors:APT-04ProfileAssessment**:
sidewindermhilzeaburrataptphishingcloudflaretor

TLP: WHITE Date: 2026-04-05 Analyst: GHOST (Breakglass Intelligence) Classification: APT (Nation-State Espionage) Investigation ID: BGI-2026-041

Executive Summary

Breakglass Intelligence investigated a SideWinder APT credential harvesting campaign targeting South Asian military and government organizations through systematic abuse of legitimate Platform-as-a-Service (PaaS) providers. Starting from a single phishing URL on Zeabur (a Taiwanese PaaS), we mapped 20 infrastructure nodes across 8 platforms spanning a 5-month campaign (November 2025 to April 2026). The campaign targets Pakistan military, Pakistan telecommunications, and Bangladesh government/military organizations using cloned Zimbra webmail login pages with a sophisticated multi-stage credential harvesting flow that collects victim passwords twice. We identified a confirmed victim email address belonging to a Margalla Heavy Industries Limited (MHIL) project coordinator, decoded directly from a phishing URL parameter. Two phishing sites remain LIVE and actively harvesting credentials as of April 5, 2026.

Key Findings

  • 20 infrastructure nodes across Zeabur (7), Leapcell (5), Railway (3), Cloudflare Workers (2), Replit (1), Back4App (1), and URL shorteners (2 services)
  • 7 confirmed/high-confidence target organizations: Margalla Heavy Industries (Pakistan defense), Bangladesh Navy, Pakistan Air Force, Nayatel (Pakistan ISP), Bangladesh Computer Council, NTC Pakistan, and an unidentified International Relations entity
  • Confirmed victim email decoded: pgcoord-251@margallahil[.]com (project coordinator at Margalla Heavy Industries)
  • Dual-harvest attack flow: Credentials stolen TWICE via sequential Zimbra-impersonating login pages with different target branding
  • 2 sites LIVE as of analysis date: contract-agreement-with-staff.zeabur[.]app and zimbramail-nayatel-com.zeabur[.]app
  • Consistent operational fingerprint: Identical parameter name gfjdliotrgojnghgherbegrehureert0e0ee across ALL instances, unique to this campaign
  • Campaign-specific PDF lures themed around Pakistani defense contracts and technical engineering documents

What Was Found vs. What Was Known

AspectPrior Reporting (@volrant136)Our Findings
Infrastructure1 URL on Zeabur20 nodes across 8 platforms, 5-month timeline
TargetsMHIL (implied)7 organizations: MHIL, BD Navy, PAF, Nayatel, BCC, NTC, IR entity
VictimsUnknown1 confirmed victim email decoded from URL
Attack FlowCredential harvesterMulti-stage dual-harvest chain with PDF lure + 2x password theft
Live StatusUnknown2 sites confirmed LIVE and actively harvesting
Platform AbuseZeabur onlyZeabur + Leapcell + Railway + CF Workers + Replit + Back4App
Campaign DurationSingle point in timeNovember 2025 through April 2026 (5+ months continuous)

Attack Chain

[Spearphishing Email]
    |
    v
[URL Shortener] (short.gy, tinyurl.cx, Replit)  <-- disposable redirector
    |
    v
[Root Page on PaaS] (Zeabur/Railway/Leapcell/CF Workers)
    |-- Displays PDF lure document in <object> tag
    |-- Auto-redirects to /load.html after 1 second
    |
    v
[Loading Page] (/load.html)
    |-- Shows loading spinner
    |-- Redirects to /login.html after 3 seconds
    |-- Passes base64-encoded victim email
    |
    v
[First Credential Harvest] (/login.html)  <-- Zimbra clone, Bangladesh Navy branding
    |-- Pre-fills victim username from base64 param
    |-- "Session Expired" social engineering
    |-- POSTs credentials to /submit
    |
    v
[Server-Side Processing] (/submit)
    |-- Stores credentials
    |-- Redirects to /login/ with base64 email
    |
    v
[Second Credential Harvest] (/login/)  <-- Zimbra clone, Pakistan Air Force branding
    |-- Pre-fills victim email from server
    |-- "Wrong password" social engineering
    |-- POSTs credentials to /try
    |
    v
[Final Redirect] (/try)
    |-- Redirects to legitimate-looking PDF document
    |-- "Contract Agreement with Stall Builder for Fabrication of Pak Pavilion.pdf"
    |-- Completes social engineering illusion

Key Insight: The dual-harvest design suggests the actor is targeting victims who may have credentials at MULTIPLE organizations (e.g., military personnel with both Bangladesh Navy and Pakistan Air Force accounts, or defense contractors with access to multiple government mail systems).

Infrastructure Analysis

Platform Abuse Timeline

DatePlatformSubdomainLure/TargetStatus
2025-11-20Zeaburpage-view-mail.zeabur[.]appMHIL (margallahil.com)DEAD
2025-12-19Zeaburstaff-performance-appraisals-nov-2025.zeabur[.]appHR/Performance review lureDEAD
2025-12-24Zeaburmaill-bcc-gov-bd-pdf.zeabur[.]appBangladesh Computer CouncilDEAD
2025-12-29Zeaburwqqwysd-qwbeaxsb.zeabur[.]appRandom subdomainDEAD
2026-01-03Back4Appmailscodomain-hubenkks.b4a[.]runZimbra genericDEAD
2026-01-04Railwayzimbra-com.up.railway[.]appZimbra genericDEAD
2026-01-06Zeabursite4-map-com.zeabur[.]appUnknown targetDEAD
2026-01-15Leapcellzimbra10-nml3wp-max8143-3ipio7e5.leapcell[.]devUnknown targetDEAD
2026-01-21Leapcellzimbra10-nml3wp-max8143-fn1rsf7l.leapcell[.]devUnknown targetDEAD
2026-01-30Leapcellzimbra10-internationalrelation40-beep5751.leapcell[.]devInternational Relations entityDEAD
2026-02-05Railwaymail-zimbra-com.up.railway[.]appZimbra genericDEAD
2026-02-26Railwayopenthesubjectfile.up.railway[.]appDocument-themedDEAD
2026-03-09Leapcellzimbramail-nayatel.leapcell[.]appNayatel (Pakistan ISP)DEAD
2026-03-10Leapcellzimbramail-nayatel-gov.leapcell[.]appNayatel (gov variant)DEAD
2026-03-11CF Workersroyal-field-9144.girlfriendparty42.workers[.]devZimbra phishingDEAD
2026-03-25CF Workerszimramail-nayatel.girlfriendparty42.workers[.]devNayatel (typo variant)DEAD
2026-03-25Replitneshortfile-showsopen-1--itdtegso2bd.replit[.]appURL redirectorDEAD
2026-03-30Zeaburcontract-agreement-with-staff.zeabur[.]appPak Pavilion / MHILLIVE
2026-03-31Zeaburzimbramail-nayatel-com.zeabur[.]appNayatel (Pakistan ISP)LIVE

URL Shortener Layer

ServiceShort URLRedirects ToDate
short.gyiqwlwj.short[.]gy/Y5qMhQZeabur phishing2026-01-07
short.gymzrakq.short[.]gy/A6tpOvLeapcell phishing2026-01-23
short.gymzrakq.short[.]gy/FCViGXLeapcell phishing2026-01-21
short.gymzrakq.short[.]gy/tmBpOWLeapcell phishing2026-01-29
short.gychdu4x.short[.]gy/MMiuEfLeapcell phishing2026-01-29
tinyurl.cxtinyurl[.]cx/clfVyRailway phishing2026-02-11
tinyurl.cxtinyurl[.]cx/eSRaMRailway phishing2026-02-05
tinyurl.cxtinyurl[.]cx/wwVrnRailway phishing2026-02-26
tinyurl.cxtinyurl[.]cx/IRkqGRailway phishing2026-02-26
Replitneshortfile-showsopen-1--itdtegso2bd.replit[.]app/HjdzisZeabur phishing2026-03-30
Replitneshortfile-showsopen-1--itdtegso2bd.replit[.]app/jVLVqnZeabur phishing2026-03-25

Network Infrastructure

IPASNProviderHostnamesServicesNotes
43.159.166.153TencentTencent Cloud (US PoP)detrouble[.]com80/443 (Apache 2.4.66, PHP 8.3.30)Zeabur load balancer

TLS Certificate

  • Subject: *.zeabur.app (wildcard)
  • Issuer: Google Trust Services (WR1)
  • SANs: *.zeabur.app, zeabur.app, *.fra1.zeabur.app, *.hkg1.zeabur.app, *.hnd1.zeabur.app, *.kix1.zeabur.app, *.sfo1.zeabur.app, *.tpe1.zeabur.app, *.tpe0.zeabur.app, *.cgk1.zeabur.app, *.sjc1.zeabur.app
  • Validity: 2026-03-12 to 2026-06-10
  • Note: Wildcard cert shared across all Zeabur deployments -- no certificate-based differentiation possible

DNS Chain

contract-agreement-with-staff.zeabur.app
    -> CNAME: sjc1.cname.zeabur-dns.com
    -> CNAME: lb-2jibk09k-1uo03wlhxdkp2yrn.clb.usw-tencentclb.com
    -> A: 43.159.166.153

Zeabur uses Tencent Cloud Load Balancer infrastructure (San Jose / US West region).

Phishing Kit Analysis

Server Technology

  • Backend: Express.js (Node.js) -- confirmed via X-Powered-By: Express header
  • Deployment: Static files + server-side routes on Zeabur PaaS
  • Last Modified: 2026-03-17 08:27:37 UTC (all static files share this timestamp)

Phishing Kit Fingerprints

ArtifactSHA256Size
commonloginzhtmlskin.css07c63a73d5f4d11f41dfe9afd9bd3a3f99a0eca4a62439cf8f03eb0964137b7865,117 bytes
zimbra.png06635593a68d32c8992ad23927074f2d8c922a9139eae7507af1879faa8c23fe14,968 bytes
CSRF token (hardcoded)ec529cbe-89f5-4964-b46f-b3dc29789899Static across all pages

Parameter Naming Convention

The actor uses long, pseudo-random parameter names as tracking/routing identifiers:

ParameterUsed OnPurpose
gfjdliotrgojnghgherbegrehureert0e0ee/login.htmlVictim email (base64), present across ALL campaign instances
bfjkdghurehgjufhdkhgruiegbvousdhfowehr/load.htmlVictim tracking, intermediary redirect
hfdgdhguirehfdhgfdrereoh/login/ (post-theft)Victim email (base64), server-generated
contract-agreement-with-staff/ (root, MHIL)Campaign identifier / entry gate
WsdftYdsfsdRadyweEdfdesIsdfjdsP/ (root, Nayatel)Campaign identifier / entry gate
weriouiof23dskjhvxwtue546iysdfcnbv/ (root, CF Workers)Campaign identifier / entry gate
oasnxsauhbasdbxsa/ (root, early)Campaign identifier / entry gate
file1newdownload7r4ygduegur7348ru2ggru/ (root, BCC)Campaign identifier / entry gate

Critical OPSEC Fingerprint: The parameter gfjdliotrgojnghgherbegrehureert0e0ee is UNIQUE to this actor and present across ALL 20 infrastructure nodes over 5 months. This is the strongest single indicator for campaign tracking and detection.

Social Engineering Lures

CampaignPDF LureTarget Context
MHIL (contract-agreement-with-staff)"Contract Agreement with Stall Builder for Fabrication of Pak Pavilion"Pakistan defense exhibition stall construction
Nayatel (zimbramail-nayatel-com)"Mechanical Interface requirements"Telecommunications engineering document
HR-themed (staff-performance-appraisals)Staff performance appraisalsGeneric HR document
BCC (maill-bcc-gov-bd-pdf)Unknown (site dead)Bangladesh government document
Document-themed (openthesubjectfile)"Open the subject file" (implied)Generic document lure

Error Messages Used

  • First harvest: "Your Session Expired Enter Password to Sign in again!!." (extra period, double exclamation)
  • Second harvest: "Wrong password re-enter your password to sign in again!!." (double exclamation)

Impersonated Services

StageServiceBanner LinkLogo
First credential harvestZimbra Web Clienthxxp://mail.navy.mil[.]bd/zimbra.png (generic)
Second credential harvestZimbra Web Clienthxxp://mail.paf.gov[.]pk/zimbra.png (generic)

Note: The alt attribute on the Zimbra logo image reads "HIT logo" -- this is a residual artifact that likely references HIT (Harbin Institute of Technology) or a prior version of the phishing kit that targeted a different organization.

Victim Analysis

Confirmed Victims

OrganizationSectorCountryEvidenceConfidence
Margalla Heavy Industries Ltd (MHIL)Defense ManufacturingPakistanVictim email pgcoord-251@margallahil[.]com decoded from URL paramCONFIRMED

Targeted Organizations

OrganizationSectorCountryEvidenceConfidence
Bangladesh NavyMilitaryBangladeshBanner link mail.navy.mil[.]bd in Stage 1 loginHIGH
Pakistan Air Force (PAF)MilitaryPakistanBanner link mail.paf.gov[.]pk in Stage 2 loginHIGH
NayatelTelecommunications/ISPPakistan4 dedicated phishing subdomains across 3 platformsHIGH
Bangladesh Computer Council (BCC)Government ITBangladeshDedicated subdomain maill-bcc-gov-bd-pdfHIGH
NTC (Pakistan)TelecommunicationsPakistanntc-logo-login.png asset in phishing kitMEDIUM
International Relations entityGovernment/DiplomaticUnknownLeapcell subdomain containing "internationalrelation"MEDIUM

Targeting Pattern

  • Geographic Focus: Pakistan (primary), Bangladesh (secondary)
  • Sector Focus: Military (Navy, Air Force), Defense Manufacturing, Telecommunications, Government IT
  • Consistent with SideWinder: India-nexus APT historically targeting Pakistan military, government, and strategic industries

Threat Actor Profile

Attribution Assessment

  • Confidence: HIGH
  • Attribution: SideWinder APT (also known as T-APT-04, Rattlesnake, Razor Tiger, APT-C-17)
  • Country/Region: India (assessed)
  • Motivation: Strategic espionage targeting Pakistan and Bangladesh military/government
  • Evidence for Attribution:
    1. Zimbra credential harvesting is a documented SideWinder TTP (multiple prior reports by Group-IB, Kaspersky, BlackBerry)
    2. Targeting profile matches SideWinder exactly: Pakistan military (PAF), Pakistan defense contractors (MHIL), Pakistan ISPs (Nayatel), Bangladesh government (BCC, Navy)
    3. Original IOC reported by @volrant136 (Hunt.io researcher) with SideWinder attribution
    4. PDF lure themes (defense contracts, Pak Pavilion) match SideWinder historical lures targeting Pakistani defense exhibitions
    5. Campaign aligns with Breakglass prior SideWinder investigations (BGI-2025-003 Azerbaijan, BGI-2026-002 WarMachine)

OPSEC Failures

  1. Reused unique parameter name (gfjdliotrgojnghgherbegrehureert0e0ee) across ALL infrastructure for 5+ months -- enables trivial campaign tracking
  2. Hardcoded CSRF token (ec529cbe-89f5-4964-b46f-b3dc29789899) is identical across all instances -- not dynamically generated
  3. Typo in PDF lure filename: Root page uses "Csontract" while final redirect uses "Contract" -- copy-paste error
  4. Typo in Cloudflare Workers subdomain: "zimramail" instead of "zimbramail" -- keyboard error
  5. Victim email leaked in URL: Base64-encoded victim email pgcoord-251@margallahil[.]com visible in URLScan submission
  6. Alt text artifact: Logo alt="HIT logo" reveals a prior kit version or shared template
  7. Same phishing kit structure across all platforms with identical CSS/JS/HTML -- no per-deployment obfuscation
  8. Express.js X-Powered-By header not disabled -- reveals server technology

Campaign Evolution (Nov 2025 - Apr 2026)

PhasePeriodPlatformsNotes
Phase 1Nov 2025Zeabur onlyInitial deployment, page-view-mail subdomain
Phase 2Dec 2025 - Jan 2026Zeabur + Back4App + Railway + LeapcellPlatform diversification begins
Phase 3Feb 2026Railway + URL shorteners (tinyurl.cx)Added redirector layer
Phase 4Mar 2026Leapcell + CF Workers + Replit + ZeaburMaximum platform diversity, Nayatel focus
Phase 5Apr 2026Zeabur (consolidated)Two active sites, matured kit

The actor progressively diversified across more platforms (likely as earlier deployments were detected/taken down) before consolidating back to Zeabur for the latest wave.

Cross-Reference with Prior Breakglass SideWinder Investigations

AspectBGI-2025-003 (Azerbaijan)BGI-2026-002 (WarMachine)BGI-2026-041 (This)
DeliveryCVE-2017-0199 RTF chainCVE-2026-21509Zimbra credential phishing
InfrastructureSelf-hosted (defence-np[.]net)VPS serversPaaS platform abuse
TargetsAzerbaijan defensePakistan SIEHS/PSCAPak military/BD gov
SophisticationCustom malware deliveryServer-side exploitationCredential harvesting
StatusCampaign closedOngoing2 sites LIVE

MITRE ATT&CK Mapping

TacticTechniqueIDApplication
ReconnaissanceGather Victim Identity Information: Email AddressesT1589.002Targeted email addresses base64-encoded in URLs
Resource DevelopmentAcquire Infrastructure: Web ServicesT1583.006Abuse of 6 PaaS platforms for hosting
Resource DevelopmentStage Capabilities: Link TargetT1608.005URL shorteners (short.gy, tinyurl.cx, Replit)
Initial AccessPhishing: Spearphishing LinkT1566.002Emailed links to phishing pages
Credential AccessInput Capture: Web Portal CaptureT1056.003Cloned Zimbra login pages
CollectionData from Information Repositories: Code RepositoriesT1213N/A
Defense EvasionMasquerading: Match Legitimate Name or LocationT1036.005Subdomains matching target org names

IOC Summary

Network Indicators (Defanged)

Active Phishing Sites (LIVE as of 2026-04-05):

  • hxxps://contract-agreement-with-staff.zeabur[.]app/login.html
  • hxxps://zimbramail-nayatel-com.zeabur[.]app/login.html

Historical Phishing Sites (DEAD):

  • hxxps://page-view-mail.zeabur[.]app/
  • hxxps://staff-performance-appraisals-nov-2025.zeabur[.]app/
  • hxxps://maill-bcc-gov-bd-pdf.zeabur[.]app/
  • hxxps://wqqwysd-qwbeaxsb.zeabur[.]app/
  • hxxps://site4-map-com.zeabur[.]app/
  • hxxps://zimbra-com.up.railway[.]app/
  • hxxps://mail-zimbra-com.up.railway[.]app/
  • hxxps://openthesubjectfile.up.railway[.]app/
  • hxxps://zimbra10-nml3wp-max8143-3ipio7e5.leapcell[.]dev/
  • hxxps://zimbra10-nml3wp-max8143-fn1rsf7l.leapcell[.]dev/
  • hxxps://zimbra10-internationalrelation40-beep5751-brqupv53.leapcell[.]dev/
  • hxxps://zimbramail-nayatel.leapcell[.]app/
  • hxxps://zimbramail-nayatel-gov.leapcell[.]app/
  • hxxps://royal-field-9144.girlfriendparty42.workers[.]dev/
  • hxxps://zimramail-nayatel.girlfriendparty42.workers[.]dev/
  • hxxps://mailscodomain-hubenkks.b4a[.]run/
  • hxxp://neshortfile-showsopen-1--itdtegso2bd.replit[.]app/

URL Shortener Links:

  • hxxps://iqwlwj.short[.]gy/Y5qMhQ
  • hxxps://mzrakq.short[.]gy/A6tpOv
  • hxxps://mzrakq.short[.]gy/FCViGX
  • hxxps://mzrakq.short[.]gy/tmBpOW
  • hxxps://chdu4x.short[.]gy/MMiuEf
  • hxxps://tinyurl[.]cx/clfVy
  • hxxps://tinyurl[.]cx/eSRaM
  • hxxps://tinyurl[.]cx/wwVrn
  • hxxps://tinyurl[.]cx/IRkqG

IP Address:

  • 43.159.166[.]153 (Tencent Cloud, Zeabur LB)

File Indicators

ArtifactSHA256
commonloginzhtmlskin.css07c63a73d5f4d11f41dfe9afd9bd3a3f99a0eca4a62439cf8f03eb0964137b78
zimbra.png06635593a68d32c8992ad23927074f2d8c922a9139eae7507af1879faa8c23fe

Behavioral Indicators

  • URL parameter: gfjdliotrgojnghgherbegrehureert0e0ee (unique campaign fingerprint)
  • URL parameter: bfjkdghurehgjufhdkhgruiegbvousdhfowehr (intermediary redirect)
  • URL parameter: hfdgdhguirehfdhgfdrereoh (post-theft redirect)
  • Hardcoded CSRF: ec529cbe-89f5-4964-b46f-b3dc29789899
  • HTTP header: X-Powered-By: Express
  • Page title: "Zimbra Web Client Sign In" (exact)
  • Error text: "Your Session Expired Enter Password to Sign in again!!."
  • Error text: "Wrong password re-enter your password to sign in again!!."
  • Logo alt text: "HIT logo"
  • Form action endpoints: /submit (first harvest), /try (second harvest)

Immediate (24-48 hours)

  1. Block all IOCs listed above at email gateway, web proxy, and DNS resolver level
  2. Notify Zeabur (abuse@zeabur.com) to take down the two LIVE phishing sites
  3. Notify MHIL (Margalla Heavy Industries) that the email pgcoord-251@margallahil[.]com has been targeted -- password reset required
  4. Notify BD-CERT regarding Bangladesh Navy targeting
  5. Notify Pakistan CERT (PKCERT/NR3C) regarding PAF and MHIL targeting
  6. Search email logs for the unique parameter string gfjdliotrgojnghgherbegrehureert0e0ee to identify any employees who clicked

Short-term (1-2 weeks)

  1. Implement detection rules (YARA/Suricata below) for the phishing kit fingerprints
  2. Monitor crt.sh and URLScan for new deployments matching the campaign fingerprint
  3. Report URL shortener links to short.gy and tinyurl.cx for takedown
  4. Notify Leapcell, Railway, Cloudflare, Replit, and Back4App of historical abuse

Medium-term (1-3 months)

  1. Block PaaS platforms at the subdomain level where organizational policy permits (especially for organizations in the target profile)
  2. Implement DMARC/DKIM/SPF enforcement to reduce spearphishing delivery success
  3. Deploy phishing-resistant MFA (FIDO2/WebAuthn) for all Zimbra deployments in targeted organizations

Abuse Reports

Zeabur (Priority: CRITICAL -- 2 LIVE sites)

To: Zeabur Trust & Safety
Subject: Active phishing sites on Zeabur platform — credential harvesting

Two active phishing deployments are impersonating Zimbra webmail to steal credentials 
from Pakistan/Bangladesh military and government personnel:

1. contract-agreement-with-staff.zeabur.app (LIVE - credential harvester)
2. zimbramail-nayatel-com.zeabur.app (LIVE - credential harvester)

These are part of a nation-state espionage campaign (SideWinder APT) that has abused 
your platform since November 2025. Seven historical subdomains have also been used.

Request immediate takedown and account suspension.

References

  • @volrant136 (Hunt.io): Original IOC disclosure (April 2, 2026)
  • @skocherhan: Repost amplifying the IOC
  • Breakglass Intelligence BGI-2025-003: SideWinder Azerbaijan Campaign (defence-np[.]net)
  • Breakglass Intelligence BGI-2026-002: WarMachine/MALDEV01 (CVE-2026-21509)
  • Group-IB (2024): "SideWinder's Credential Phishing Operations Against South Asian Governments"
  • BlackBerry (2023): "SideWinder Uses Server-Side Polymorphism to Attack Pakistan Government"

GHOST -- Breakglass Intelligence "One indicator. Total infrastructure."

Share