SideWinder APT Leverages Cloudflare Workers and Tailored PDF Lures in Sophisticated Zimbra Phishing Campaign

A highly sophisticated credential-harvesting operation, attributed to the SideWinder APT, has been identified targeting critical South Asian government infrastructure. The campaign utilizes a multi-stage attack chain designed to bypass traditional scrutiny by leveraging legitimate cloud developer platforms, specifically Cloudflare Workers, to host pixel-perfect clones of Zimbra webmail interfaces.

Recent intelligence confirms that the primary targets include the Bangladesh Navy (targeting the mail.navy.mil.bd portal) and Pakistan’s Ministry of Foreign Affairs. By hosting malicious components on workers.dev, the threat actors effectively blend their command-and-control (C2) and phishing traffic with legitimate global cloud service traffic, making detection through standard domain reputation filtering significantly more difficult.

The “Z2FA_LTS” Framework: Modular and MFA-Aware

Technical analysis of the phishing kit reveals an internal identifier, “Z2FA_LTS,” suggesting a structured, long-term development lifecycle. This nomenclature indicates a modular framework engineered to be “Two-Factor Authentication (2FA) aware,” allowing the attackers to potentially intercept or bypass secondary authentication layers during the harvest.

During forensic investigation, researchers uncovered a significant operational security (OPSEC) failure. By issuing a malformed POST request without an expected form body to the Express.js backend running on the Cloudflare Worker, the application triggered an unhandled error. The resulting stack trace leaked critical filesystem metadata, including:

• The developer’s local Linux home directory (/home/moincox/).
• The project working directory (Z2FA_LTS).
• Specific source code entry points (app.js) and handler logic for both victim credential exfiltration and the administrative management interface.

The Attack Chain: Psychological Manipulation via PDF.js

The campaign employs a clever two-step psychological lure to bypass user suspicion. Rather than landing directly on a login page, the victim is first presented with a fake Chrome PDF viewer. This interface utilizes PDF.js to render what appears to be an official document hosted on the legitimate government domain.

To create a sense of technical friction, the displayed document is intentionally rendered as blurred or partially opaque. This forces the user into a “decision point”: they must either wait for a simulated reload or click a “Reload PDF” button. Both actions trigger a redirect to the second stage: a cloned Zimbra Harmony skin login form.

This second stage is highly advanced, pulling legitimate CSS assets directly from the actual government mail servers to ensure visual parity. The backend reverse-proxies assets and injects custom scripts to maintain the illusion, even pre-filling the username field after a failed attempt to encourage the victim to “correct” their password—thereby feeding the attacker the right credentials.

Intelligence-Driven Lures: The Recycling of Sensitive Data

Perhaps most concerning is the content of the initial PDF lure. Analysts determined the document is not a generic decoy, but a genuine Pakistani diplomatic document containing sensitive information regarding officials and hotel reservations for an IPU assembly in Istanbul.

This highlights a hallmark of SideWinder’s methodology: lateral intelligence recycling. The group exfiltrates sensitive documents from one victim and immediately repurposes that specific data as a hyper-tailored lure for other targets within the same geopolitical sphere, drastically increasing the success rate of their social engineering.

Infrastructure Persistence and Defensive Posture

Through passive DNS analysis and URL indexing, investigators have traced at least seven distinct Cloudflare Workers connected to this specific toolkit. The infrastructure is distributed across multiple accounts (e.g., "girlfriendparty42" and "malik-jaani786"), indicating a sustained, professionalized operation targeting telecoms, military entities, and even private iCloud users.

Recommended Mitigations for Security Operations Centers (SOC):

• Zero Trust Architecture: Enforce phishing-resistant MFA (such as FIDO2/WebAuthn) to negate the effectiveness of harvested credentials.
• Domain Monitoring: Implement heightened scrutiny for any authentication interfaces (Zimbra, Outlook, etc.) hosted on generic PaaS/Cloud domains like *.workers.dev or *.appspot.com.
• Traffic Analysis: Monitor for anomalous web traffic featuring long, randomized query parameters (often used as “gate” parameters) and unusual POST requests to developer-centric subdomains.
• Email Security: Inspect incoming attachments for PDFs that trigger immediate redirects or utilize obscured/blurred content as a way to bypass sandboxing and human scrutiny.