Assessments: 

• We assess with high confidence that MoI&P EV Subsidy 2026 .doc is a malicious lure document that initiates a remote-template-injection infection chain terminating at ministry-of-industries-and-production[.]elagonte[.]info, and with high confidence that the content recovered from that template URL is a deliberate anti-analysis cloak, not the attacker's live payload. 

‍

• We assess with high confidence that the same “/ifle” delivery-path fingerprint, and in two cases the identical “DHA Gandhara Phase-9” lure document, spans at least three separate hosting domains (elagonte[.]info, vagued[.]live, info-lanka[.]com), indicating a shared kit rather than coincidence. 

‍

• We assess with medium confidence that elagonte[.]info and vagued[.]live each represent a single operator's own dedicated, sustained infrastructure, and with low confidence that info-lanka[.]com is dedicated infrastructure for this actor specifically rather than one tenant among many on a long-running shared or bulletproof host (the kit fingerprint still ties its activity to the same campaign). 

‍

• We assess pncert[.]info's lure document at high confidence as a deliberately crafted, topical phishing document impersonating the Philippines' National Computer Emergency Response Team and timed to a real legislative event, and at low-to-medium confidence that it was built and operated by the same actor as the core Pakistan/Djibouti “/ifle” campaign, given a roughly 22-month gap from this campaign's other activity and the absence of a shared file hash or corroborating passive DNS. 

‍

• We assess with medium-to-high confidence that Pakistan is a genuine, affected target base rather than an artifact of lure theming alone, based on three independent VirusTotal submissions of three different samples directly from Pakistan, each within a day of that lure's own first-seen date.

• We assess specific actor attribution at medium-to-high confidence considering the technique, targeting pattern, and Djibouti-themed lure are consistent with the India-linked SideWinder APT, reinforced by Joe Sandbox's own YARA and network-signature classification of the vagued[.]live sibling sample as SideWinder. 

‍

• Following direct file analysis, we assess with high confidence that two further samples contacting unrelated Azerbaijan- and Bangladesh-themed domains (defence-np[.]net, fetchdrive[.]org) are the same App.dll loader, built from the same pipeline as each other (identical .NET Module Version ID and PE compile timestamp). 

‍

• We assess with low-to-medium confidence that this shared pipeline is operated by the same actor behind the Pakistan/Djibouti “/ifle” campaign specifically, rather than a related or tooling-sharing operator, since neither new domain uses the “/ifle” convention and we lack a direct file-level comparison against the vagued[.]live App.dll hash.

‍

Executive Summary

Augur Research has identified a phishing and malware delivery campaign targeting Pakistani government and military personnel, and separately Djiboutian maritime authorities, through weaponized Word documents that fetch a remote template from attacker-controlled infrastructure. The campaign uses a shared delivery kit, identifiable by a distinctive “/ifle” URL path, across at least three domains, and we attribute it with medium-to-high confidence to the India-linked SideWinder APT. SOC teams, threat hunters, and CTI analysts covering South Asian government, defense, or maritime-sector targets should track the indicators in this report and the detection guidance under Recommendations. 

‍

In late September 2026, a weaponized document titled “MoI&P EV Subsidy 2026 .doc” targeted Pakistani government and quasi-government personnel under the guise of an electric-vehicle subsidy notice from the Ministry of Industries and Production. Opening the document is enough to compromise the host. The file is a modern Word (OOXML) document disguised behind a legacy .doc extension, and it carries a remote template reference that Word resolves automatically once the victim accepts a fake “password protected” prompt and clicks Enable Editing.

‍

That template reference points to ministry-of-industries-and-production[.]elagonte[.]info, a subdomain of attacker infrastructure hosted at 193[.]29[.]57[.]28 in Germany. We followed up directly on that URL and recovered what the server hands back: not a weaponized template, but a deliberately inert HTML page (gibberish text spanning at least seven Unicode scripts and a randomly generated placeholder image), engineered to be unique on every request and to do nothing at all. This is a server-side cloak. The operator withholds the live payload from requesters it doesn't recognize as genuine victims, which is why repeated detonation of the sample never recovered a functional second stage. 

‍

elagonte[.]info is not a single-purpose phishing page but a standing, actively managed operation. Passive DNS enumeration shows roughly thirty subdomains built on this one host between 2026-08-21 and 2026-09-25, authenticated email-sending infrastructure (DKIM configured for both Google Workspace and Microsoft 365), a recurring generic lure (“appoinment”) reissued with a freshly randomized token per target, a “maldoc” staging subdomain, and named impersonations of at least three Pakistani government bodies, Ministry of Industries and Production, Cabinet Division, and Defence Housing Authority. The buildout cadence, a new named-entity lure roughly every one to two weeks, points to an ongoing campaign rather than a single opportunistic attack.

‍

Pivoting on the “Defence/Defense Housing Authority” lure theme surfaced the same delivery-path fingerprint (a URL ending in /ifle, reached through a per-target random token) reused across three further domains. vagued[.]live and info-lanka[.]com both host a “DHA Gandhara Phase-9 Notification and Application Form.doc” lure under this exact path convention, and a lower-confidence fourth domain, pncert[.]info, hosts a differently themed but identically structured lure. vagued[.]live is a second dedicated, actor-built domain in its own right. Its subdomain list adds a Pakistani Ministry of Foreign Affairs lure (mofa-gov-pk) and a likely Djibouti Ports and Free Zones Authority lure (dpfza-gov-dj), extending this operation's targeting beyond Pakistan for the first time. info-lanka[.]com, by contrast, carries dozens of unrelated brand-impersonation subdomains (11st, Rakuten, Outlook, Yahoo, shiabank.com, and others) spanning years, and we assess it as long-running shared or bulletproof hosting rather than infrastructure this actor owns outright. Its DHA lure is one tenant's activity on a host many others also use, tied to this campaign only by the matching kit fingerprint and lure document.

‍

The combination of macro-free remote template injection, ministry- and port-authority-themed lure domains targeting Pakistan and Djibouti, and server-side cloaking against analysis matches a pattern publicly associated with SideWinder, an India-linked actor with a long record of using this combination against Pakistani government and military targets, and whose documented 2024-2025 campaigns separately pivoted toward maritime and port-authority targets including Djibouti. No domain, IP address, or file hash in this case has previously appeared in public reporting, so the SideWinder association below is a technique-and-targeting match, not a confirmed linkage.

‍

Stage 1: The Lure Document

The attachment is presented to the victim as “MoI&P EV Subsidy 2026 .doc,” a plausible notice from Pakistan's Ministry of Industries and Production. Despite the legacy .doc extension, file-format analysis identifies it as a ZIP archive, a modern Word 2007+ (OOXML) document handled internally under a double extension (MoI_PEVSubsidy2026.doc.docx). This lightweight masquerading technique relies on Windows hiding known file extensions by default.

‍

Static signature detection against the file remains minimal. A single engine out of roughly two dozen checked flags it, meaning this sample passes most mail- and endpoint-gateway filtering and depends on behavioral or network telemetry to be caught.

Stage 2: Remote Template Injection

Opening the document in three separate environments, spanning Windows 7 through Windows 11 and Office 2010 through Office 2016, produced the same sequence every time. WINWORD.EXE resolves ministry-of-industries-and-production[.]elagonte[.]info, then issues outbound HTTPS requests to it (OPTIONS /s/d7375881/, then GET /s/d7375881/ifle). Word additionally probes several template extension variants against the same path:

‍

‍

This extension-probing pattern (.dotx, .dotm, .dot) is characteristic of an OOXML “attachedTemplate” external reference, the document's relationship data points at a remote template, and Word tries the standard template extensions to resolve it. A \PIPE\DAV RPC SERVICE named pipe, the WebClient/WebDAV redirector Word uses when a remote template target is reachable over WebDAV, confirms the mechanism. This is macro-free delivery requiring no interaction beyond “Enable Editing”. The string “password-protected” recovered from the document's own on-open prompt is the lure that gets a victim to accept that one click, after which the template fetch proceeds on its own.

‍

Stage 3: The Captured Response, An Anti-Analysis Cloak

Following up directly on the template-fetch URL recovers what the server actually hands back. It is not a weaponized template. It is a 17.5 KB standalone HTML file whose visible content is manufactured noise, a page title, heading, and body text built from a mix of at least seven unrelated Unicode scripts with no coherent meaning in any language, and a single embedded image, a randomly generated composition of unrelated geometric shapes overlaid with placeholder “404” text and additional unrenderable glyphs. The page carries no script, no form, and no further external references of its own.

‍

‍

We assess this is a deliberate cloaking response, not a broken or abandoned endpoint. The HTML wrapper recovered here is built to be unique and meaningless at the same time, manufactured, incoherent multi-script text wrapped around content that performs no action and leads nowhere. We do not think that every element of every cloak response is freshly randomized on each request. As detailed under the sibling-domain sections below, we recovered the same decoy image, byte-for-byte identical, from two separately captured artifacts tied to different domains, indicating the kit draws on a small, reused pool of decoy content rather than generating something unique every time. The outer HTML page itself may still vary per request or per token, but static signature matching on the cloak's generated noise is, at best, an unreliable detection approach. All three detonation attempts against the live URL, across three different operating-system and Office-version combinations, received this same kind of inert response rather than a functional macro, exploit, or further document. That is consistent with a server that fingerprints the requester, most plausibly by source IP geolocation, request timing, or the one-time token embedded in the URL path itself (/d7375881/), and serves this decoy to anything it does not recognize as a genuine, in-region victim. It is the same operating principle documented in SideWinder's 2026 campaign against Pakistan, in which non-Pakistani requests to the attacker's infrastructure received a minimal stub response while Pakistani victims received the real, multi-hundred-kilobyte malicious payload.

‍

Supporting Network Contacts

Alongside the malicious fetch, the document session also touched a handful of legitimate Microsoft and CDN endpoints, incidental to simply having Word and Office telemetry running on the host:

‍

‍

Sibling Infrastructure: The “/ifle” Kit Fingerprint

The template-fetch path recovered in Stages 2 and 3 (a per-target random token ending in /ifle, e.g. /s/d7375881/ifle) is not unique to elagonte[.]info. The same path convention, and in two cases the identical lure document, appears across three further domains, pointing to a shared delivery kit used well beyond this one host. A fourth domain follows the same convention at lower confidence in its relationship to the others.

‍

Confirmed sibling: defence-housing-authority[.]elagonte[.]info

A second file hash contacts defence-housing-authority[.]elagonte[.]info at the URL hxxps://defence-housing-authority[.]elagonte[.]info/applicationform/29925140/ifle, the same parent domain and host as the primary sample, impersonating a different Pakistani entity, first observed 2026-08-25:

‍

‍

Given the shared hosting, URL path convention, matching lure pattern, and the cloaking behavior demonstrated on the primary sample, we assess with high confidence this is a sibling lure document from the same elagonte[.]info operation.

‍

vagued[.]live: a second dedicated domain

A third sample, also titled “DHA Gandhara Phase-9 Notification and Application Form.doc” but with a distinct hash, contacts hxxp://defense-housing-authority[.]vagued[.]live/20aa11a0_f/ifle, the same kit fingerprint, on unrelated registration and hosting:

‍

‍

Passive DNS for 195[.]54[.]160[.]145 shows vagued[.]live is itself dedicated, actor-built infrastructure rather than a shared host; every subdomain observed is consistent with a single phishing/credential-harvesting operation. The buildout includes both spellings of the Defence/Defense Housing Authority lure (defense-housing-authority and defence-housing-authority), a Pakistani Ministry of Foreign Affairs lure (mofa-gov-pk, active 2026-08-12 to 13), fake Office-update lures (msofficeupdate and msofficeupdator, both active into early September, the classic social-engineering cover story for a remote-template fetch), DKIM records for authenticated email, and generic phishing-kit scaffolding (admin, dashboard, backoffice, studio, account, client, clients, staff, api). Most significantly, dpfza-gov-dj[.]vagued[.]live (first seen 2026-08-09 to 10) is a plausible impersonation of the Djibouti Ports and Free Zones Authority (DPFZA). The first indication in this campaign of targeting outside Pakistan, and, as discussed under Assessment and Attribution below, a specific match to a maritime/port-authority targeting pivot documented for SideWinder.

‍

A separate artifact is the first direct evidence of vagued[.]live's own template-fetch cloak response. It is a standalone Microsoft Word document: SHA25607, cf38a134231ab9ea5ac5bcbf07bf37699919e4ca0d483b068303a22b285ff9, 

‍

SHA1 991e926b6010d2e21a0542411811ec8325aeeebe, MD5 2b8d9cfbf7a3bc7969936629dc6aef56. Direct inspection of its full OOXML structure (relationships, hyperlinks, field codes, webSettings, and a whole-tree text search) found no domain name, URL, macro, or OLE embedding of any kind; it is an unmodified copy of Microsoft's own stock “Report” template, carrying only generic placeholder and instructional text (Template: Normal.dotm), with a single change. Its one embedded image has been swapped for a JPEG (1275x1650px, 277,656 bytes) whose SHA256, b96f480f71819a1e0028b2bc700434745f60132555ce14802f8c70127c23216c, is byte-for-byte identical to the decoy JPEG independently captured from info-lanka[.]com's sandbox detonation, below. Its docProps/core.xml records a last-modified timestamp of 2026-08-05T11:29:00Z, roughly five minutes after the vagued[.]live DHA Gandhara sibling sample's own VirusTotal submission at 2026-08-05 11:23:46 UTC (see Victim Submission Geography below), consistent with this being the cloak response the kit's vagued[.]live endpoint served around the same time that sample was circulating. We assess this ties the anti-analysis cloaking behavior directly to vagued[.]live for the first time (previously documented only at elagonte[.]info directly and info-lanka[.]com via sandbox), and that, because the identical image hash now appears in two independently captured artifacts from two different domains, the kit draws on a small, reused pool of decoy images rather than generating a unique one on every request. 

‍

An independent Joe Sandbox analysis of this same vagued[.]live sibling sample (3b9432019a80a62fe6760a65f2677783bd60383b60206a5db7237a1b050647a2, analyzed 2026-08-06) is, to date, the deepest technical look this investigation has had at the kit's post-template-fetch behavior, and the first to recover the chain beyond the cloak-image stage. Per that report, opening the document triggers the same remote template injection documented in Stage 2, writing a retrieved file to %TEMP%\file2.dot. The chain then drops and runs App.dll (SHA256 03d55a27b1ef9f4c3dffc0c590d4e095fcbb3b714f5102c0c17928f94d545d52, MD5 fea536c4fa5a3766f1810101431c2f07), which fingerprints the host via WMI (enumerating installed antivirus products through root\SecurityCenter2\AntiVirusProduct and enumerating running processes) and reports that information to hxxps://defense-housing-authority[.]vagued[.]live/71380eac_f/data?k=5jxs3yszgck. It then downloads a second file from hxxps://defense-housing-authority[.]vagued[.]live/c9505521_f/dcy, writes it to %TEMP%\file2.dot, and launches it using a method apparently chosen by which security product it detected on the host (our source material is not fully consistent on the exact branching logic here; see caveat below), but agrees it is AV-specific rather than a single fixed launch method. Separately, it downloads a further encrypted stage from hxxps://defense-housing-authority[.]vagued[.]live/325a541c_f/roxpy?k=5jxs3yszgck, decrypted with a cyclic XOR key taken from the payload's own first 32 bytes and loaded directly into memory as a .NET assembly via Assembly.Load (no file written to disk for this stage), then executed through a .NET BinaryFormatter deserialization gadget (ActivitySurrogateSelector) and an exported “Program” type. A hard-coded kill-switch runs earlier in this sequence; if avp.exe or avpui.exe (Kaspersky) are found running, the malware clears its execution flag and kills its own process rather than continuing. This is anti-analysis logic layered on top of, not instead of, the server-side cloaking already documented in Stage 3.

‍

App.dll itself is a 32-bit, unsigned .NET assembly targeting CLR v2.0.50727 (the .NET 2.0/3.5 runtime, a common choice for malware relying on BinaryFormatter deserialization and in-memory assembly loading), organized around a main App.Program class with a nested WebClient-derived helper that appears to add automatic response decompression. Its code is obfuscated at the method-name level; identifiers are nonsense concatenations of real English words rather than meaningful names, and it decodes 337 embedded strings at runtime through a simple per-character subtraction cipher rather than storing them in plaintext. This suggests a purpose-built loader rather than a reused, off-the-shelf tool.

‍

Two further points from this report stand out. First, Joe Sandbox's automated YARA and network-signature matching classified this sample as associated with SideWinder, the first attribution in this investigation to rest on an independent vendor's detection of this campaign's file hash, rather than on our technique-and-targeting comparison alone. We treat this as a meaningful, though not dispositive, strengthening of the SideWinder hypothesis. Second, two recurring values in the decoded chain read as durable, actor-side tracking identifiers rather than one-off artifacts: a campaign key (5jxs3yszgck) shared across the /data and /roxpy requests, and a hard-coded campaign or victim tag (TYP1S-ABCD) embedded directly in App.dll. Both are worth hunting for across other samples and infrastructure, independent of any one domain.

‍

info-lanka[.]com: shared or bulletproof hosting

A fourth sample contacts hxxps://defense-housing-authority[.]info-lanka[.]com/59274557-s/ifle, resolving to 5[.]230[.]41[.]113. A third-party Falcon Sandbox detonation (Hybrid Analysis) of this exact file, independently obtained, supplies a file hash and confirms the delivery mechanism in detail:

‍

‍

This detonation is a materially stronger confirmation of a shared kit than the matching lure document and URL path alone. The sandbox independently recorded the same two-step HTTP request sequence observed on the primary elagonte[.]info sample (an OPTIONS request to /59274557-s/, followed by a GET to /59274557-s/ifle), the same \PIPE\DAV RPC SERVICE named pipe used for the WebDAV template-fetch mechanism, and, via OCR'd sandbox screenshots of the document on open, the same “password-protected” social-engineering prompt text. All three are mechanism-level matches, not just shared theming.

‍

Most significantly, the sandbox also captured the server's response, a dropped, high-entropy JPEG (9A098678.jpeg, 271.1 KiB, SHA256 b96f480f71819a1e0028b2bc700434745f60132555ce14802f8c70127c23216c, 1275x1650px) written to the same Office template-cache location (%LOCALAPPDATA%\Microsoft\Windows\INetCache\Content.MSO\) as the embedded image recovered directly from elagonte[.]info in Stage 3, a different file format (JPEG here vs. PNG there), different dimensions, and a different hash from elagonte[.]info's own cloak image. We read this as independent, third-party confirmation that the anti-analysis cloaking behavior documented in Stage 3 is a feature of the shared kit itself, now observed on a second, unrelated domain, rather than something specific to elagonte[.]info's own server configuration. This same JPEG hash recurs in a separate artifact we attribute to vagued[.]live (see the vagued[.]live section above), so while the cloak image differs between domains, it is not uniquely generated on every request. The kit appears to serve from a small, reused pool of decoy images rather than randomizing one per request.

‍

Unlike elagonte[.]info and vagued[.]live, info-lanka[.]com shows no sign of being dedicated to a single operator. Passive DNS for 5[.]230[.]41[.]113 going back to February 2026, and, for other domains on the same IP, as far back as 2014, shows dozens of subdomains impersonating entirely unrelated brands and services with no thematic connection to this campaign: 11th and rakutenid (e-commerce), outlook, yahoo, and oauthlogin (webmail/OAuth credential panels), a separate domain shiabank[.]com, and generic SaaS-style scaffolding (gitlab, grafana, zendeskverification, passbolt). This pattern, many unrelated, simultaneously active phishing themes layered on one long-lived host, is the signature of a shared or bulletproof hosting provider serving multiple, likely unrelated, phishing operations rather than infrastructure this actor built and controls outright.

‍

pncert[.]info: lower-confidence, differently themed

A fifth sample, with a distinct filename and theme, follows the identical “/ifle” path convention under a “regulations” subdomain:

‍

‍

We assert this one at lower confidence. The path convention matches the other four, but there is no shared file hash, no passive-DNS corroboration for either IP, and a different lure theme (a numbered “Act” / regulatory-notification document rather than a named ministry or authority). The domain name itself is ambiguoWe now carry this one at low-to-medium confidence, up from the low confidence we assigned when this report was first drafted. The path convention still matches the other four, and there is still no shared file hash and no passive-DNS corroboration for either IP, but the filename itself is no longer unexplained. ACTNO12024-08102024.doc decodes to “Act No. 12024, 08-10-2024” (day-month-year), and Republic Act No. 12024 is a real Philippine law, the Self-Reliant Defense Posture Revitalization Act, signed by President Ferdinand Marcos Jr. on 2024-10-08. The domain name is also a closer match than we first found; PNCERT is a commonly used short name for the Philippines' own National Computer Emergency Response Team (NCERT-PH, ncert.gov.ph), a government cybersecurity body under the Department of Information and Communications Technology. Pakistan's PKCERT (also styled nCERT) and India's NCERT, the two candidates we considered previously, are both weaker fits now that the lure document itself is confirmed Philippine in origin.

‍

The VirusTotal submission date now reads as corroborating evidence rather than an inconsistency. The sample was submitted from the Philippines on 2024-10-15, seven days after Republic Act No. 12024 was signed into law, consistent with a lure document built and circulated while the legislation was still current news, the same kind of topical, freshly themed targeting seen elsewhere in this report (the Ministry of Industries and Production EV subsidy lure, the Azerbaijan-Russia diplomatic-crisis lure). It remains roughly 22 months before every other date associated with the rest of this campaign (2026-07 through 2026-09), and there is still no shared file hash or passive-DNS corroboration tying it to elagonte[.]info, vagued[.]live, or info-lanka[.]com. We read this as a genuine, deliberately crafted phishing document that reused the same “/ifle” kit well before the core Pakistan/Djibouti activity documented elsewhere in this report, rather than noise or an unrelated coincidence, but whether it was built and operated by the same actor, an earlier use of a shared kit, or a different operator entirely remains an open question.

‍

This also bears on SideWinder attribution. Securelist's own 2024 SideWinder reporting, the same report already cited elsewhere in this document for this actor's maritime and Djibouti targeting, names the Philippines directly as a target country, alongside Djibouti, Pakistan, Bangladesh, and Egypt, and separately notes that SideWinder's maritime- and logistics-sector targeting "expanded to Southeast Asia" through 2024. A national defense-industry law is a plausible fit for that same collection interest. This is thematic and geographic corroboration, not a technical link; we have no shared file hash, YARA hit, or infrastructure overlap tying this specific sample to SideWinder, so it carries the same evidentiary weight as the other geopolitical-context paragraphs in this report rather than raising the headline SideWinder confidence level.

‍

Summary Across Sibling Domains

‍

‍

Victim Submission Geography

Independent of passive DNS and sandbox detonation, each sample's submission history to public malware repositories is another data point: where and when a public scanning service first saw the file reflects who actually encountered and uploaded it.

‍

‍

Related Infrastructure: Broader App.dll Loader Reuse

We directly examined two further samples supplied as files, confirming what the previous section could only infer from a URL pattern. Both are PE32 .NET assemblies, 56,320 bytes each, and both carry a PE version resource whose OriginalFilename and InternalName fields literally read “App.dll”, direct confirmation, not inference, that these are the same loader documented for the vagued[.]live sibling sample above. More strikingly, the two files are near-identical at the binary level. Both share the exact same .NET Module Version ID (MVID 1e0e951c-e95e-490f-ba59-f3107a8f6d97) and the exact same PE compile timestamp (0xCA4B1D71, which decodes to a nonsensical future date of 2077-07-19, evidently a fixed or garbage value from the build pipeline rather than a genuine timestamp), along with identical blank FileDescription/LegalCopyright fields and identical 0.0.0.0 version strings. An identical MVID does not occur by coincidence between independently compiled binaries; it indicates both were produced by the same build process, most likely the same tool stamping a template binary with per-target configuration rather than two separate compilations. The remainder of the file differs almost entirely byte-for-byte, but this is fully explained by the different lengths of the embedded target URLs shifting every subsequent offset in the file, not by different code.

‍

Both samples' import/API surface independently corroborates the Joe Sandbox-derived narrative for the vagued[.]live App.dll (see above), this time from direct analysis rather than a web-report extraction, a full WMI stack (ManagementObjectSearcher, ManagementScope, ManagementPath, InvokeMethod) for antivirus-product and process enumeration; System.Net.WebClient and HttpWebRequest with AutomaticDecompression set (matching the earlier-inferred GZip auto-decompression behavior); System.Reflection (Activator.CreateInstance, Assembly.GetExportedTypes, InvokeMethod) for dynamically loading and invoking a further stage; Convert.FromBase64String; and file I/O (WriteAllBytes, WriteAllText, ReadAllText) consistent with the %TEMP% staging behavior documented earlier. Each class and method name is obfuscated the same way as reported for the vagued[.]live sample, nonsense concatenations of real English words (genuinerealgoblintrail, dewdroplanezenithreach for the Bangladesh sample; infinitestretchreflectivemirror, wizardtowerlimitededge for the Azerbaijan one), and each assembly defines the same small structure, an App.Program class plus two helper classes, eight methods total. We could not compare this MVID or timestamp against the specific vagued[.]live App.dll hash (03d55a27b1ef9f4c3dffc0c590d4e095fcbb3b714f5102c0c17928f94d545d52) documented earlier, since we do not have that file directly. This confirms a shared builder across these two samples with high confidence, and a structural/functional match to the vagued[.]live loader, but stops short of a byte-level tie to that specific hash.

‍

Azerbaijan-Russia diplomatic-crisis lure

SHA256 85359a075affaa40b215c795a095bdb3d7a07c285e4dc8abd1b3d321ad10219b contacts three endpoints, under a subdomain styled as an internal advisory on Azerbaijan-Russia relations, hxxps://internal-advisory-azerbaijan-russia-diplomatic-crisis[.]defence-np[.]net/2ec7df9e-Fwd, /b2352194-Fwd, and /e8939577-Fwd.

‍

It was first seen (VirusTotal submission) from Azerbaijan on 2026-04-14 12:57:54 UTC, about five months before the earliest first-seen date we have for the elagonte[.]info/vagued[.]live “/ifle” kit (vagued[.]live, 2026-06-24), meaning this loader's use predates the Pakistan-themed activity documented elsewhere in this report rather than following it.

‍

The lure theme has genuine real-world grounding as Azerbaijan and Russia underwent a well-documented diplomatic crisis from June through October 2025 (triggered by a fatal Russian police raid on ethnic Azeris and an unresolved December 2024 airliner shootdown), and reporting through 2026 describes tensions as subdued but with underlying distrust persisting. This is a plausible, topical pretext for an “internal advisory” lure aimed at a government, diplomatic, or defense-sector target with an interest in the Azerbaijan-Russia relationship, even though the acute “crisis” label applies most precisely to mid-to-late 2025 rather than the sample's own April 2026 first-seen date.

‍

Bangladesh Ministry of Finance lure

SHA256 c0b2bd583683b839f8cdbcf056bc87d94d7538a84b70ace1829a5c0090f8ea2c contacts hxxps://mof-portal-gov-bd[.]fetchdrive[.]org/67bbd114, /c513bd48, and /11ef6c6b, confirmed verbatim in the file's own string table, a lure styled as a Bangladesh Ministry of Finance (“MoF”) portal, hosted on a generic, file-sharing-style domain rather than a dedicated government-lookalike one. It was first seen (VirusTotal submission) from the United Kingdom on 2026-08-07 04:54:20 UTC, two days after the vagued[.]live DHA sibling sample's own VirusTotal submission (2026-08-05), a timing proximity worth noting but not, by itself, evidence of a shared operation.

‍

This changes our confidence picture from the previous round of this report, where we could only infer App.dll from a URL shape and had not examined either file. We are now highly confident these two samples are the same loader, built from the same pipeline as each other. What remains unconfirmed is whether that pipeline is operated by the same actor responsible for the Pakistan/Djibouti “/ifle” campaign documented in the rest of this report, versus a related or tooling-sharing operator, as neither defence-np[.]net nor fetchdrive[.]org uses the “/ifle” path convention, and we have no direct file-level comparison against the vagued[.]live App.dll hash itself. We treat this as a well-confirmed, separate finding that broadens the known footprint of this loader, and by extension whoever builds and deploys it, rather than as an extension of the core campaign's own confidence levels.

‍

Campaign Infrastructure: elagonte[.]info Buildout

Passive DNS enumeration of elagonte[.]info shows a single actor-built hosting footprint rather than scattered or reused infrastructure; every one of the roughly thirty subdomains observed between 2026-08-21 and 2026-09-25 resolves to the same IP, 193[.]29[.]57[.]28, under name-based virtual hosting. The buildout follows a recognizable pattern. The operator stood up the root domain, mail service, and DKIM records for both Google Workspace and Microsoft 365 around 2026-08-21, infrastructure for sending authenticated phishing email, not merely hosting pages. A generic lure subdomain (“appoinment”) went into reuse almost immediately, reissued with a freshly randomized per-target token each time through mid-September. Named-entity lures followed at roughly one- to two-week intervals: Cabinet Division (first seen 2026-09-02, reused 2026-09-16), Defence Housing Authority (first seen 2026-08-25 via the related sample above, active again 2026-09-22), and Ministry of Industries and Production (2026-09-25, the lure used in the primary sample). A subdomain literally named “maldoc” appeared on 2026-09-18, which we read as payload-staging space rather than a lure page in its own right.

‍

This cadence, a new named-entity lure roughly every one to two weeks over more than a month, with the generic lure still being reissued as of mid-September, indicates an active, ongoing campaign rather than a single completed attack.

‍

‍

The remaining randomized subdomains not nested under a named theme (aq7jpethxc, zzqx155125ba, rdfg, y81z86zqt8aqrqrp, yqvl6y5ey1bcs78l, d5wc51t4z6b250s9, t4uvmnwlcbijrev9, 9o3rs3cum1d07bdb, t8tl7shx4stq0cmo, 0y7qdsqm9cevyi2z) most likely belong to lure themes not captured by this particular pDNS pull, or predate the operator's switch to nesting per-target tokens under a named theme subdomain.

‍

Other Notable Host Artifacts

The double file extension noted in Stage 1 extends to a dropped shortcut and lock file under the same MoI_PEVSubsidy2026.doc.docx name (ATT&CK T1036.007, Masquerading), consistent with a legacy .doc filename used to mask an OOXML .docx container.

‍

A cached file, 82C6440B.jpeg (181.1 KiB), was also written to the local Office template cache. It carries unusually high entropy for a JPEG, but its structure is a valid, progressive JFIF image (1440x2038), consistent with genuine cached content from the externally referenced template path rather than a disguised payload.

‍

The remaining dropped artifacts (a .LNK shortcut, a Word lock file, Word14.customUI, index.dat, FSD/FSF Office File Cache entries, the default Normal template, and autosave .tmp files) are standard byproducts of opening a Word document on the host and are not independent indicators of compromise.

‍

MITRE ATT&CK Techniques Observed

‍

‍

Assessment and Attribution

‍

Geopolitical context

This activity sits against a Pakistani government under sustained, concurrent pressure on several fronts in 2026, any one of which supplies a plausible intelligence-collection motive for an India-linked actor. Pakistan and Afghanistan have been in open conflict along the Durand Line since February 2026 (Pakistan's defence minister termed it Operation Ghazab lil-Haq), and fighting resumed and escalated sharply from 2026-09-18 after a militant splinter group's attack on a police compound. Pakistan conducted retaliatory airstrikes into Afghanistan as recently as 2026-09-24, and Prime Minister Shehbaz Sharif addressed the conflict at the UN General Assembly the same week this campaign's primary lure document first appeared. Separately, Pakistan played a central but costly diplomatic and military role in the 2026 Iran war earlier in the year, brokering a ceasefire and hosting peace talks while absorbing a domestic energy crisis, fuel-price shocks, and the Pakistan Navy standing up Operation Muhafiz-ul-Bahr to protect Gulf shipping, a period that separately saw real, documented cyberattacks on Pakistani state television and government-adjacent infrastructure. Underlying all of this is the unresolved aftermath of the May 2025 India-Pakistan conflict (Operation Sindoor / Operation Bunyan-un-Marsoos), the most intense direct clash between the two since 1971, which itself included cyberattacks by Pakistan against Indian military and government systems. The ceasefire has held, but mutual flight restrictions and an adversarial footing persisted well into 2026. A live border war, a costly regional mediator role, or the long-running India-Pakistan rivalry each provides sufficient motive for sustained intelligence collection against Pakistani ministries, cabinet machinery, and the military's own institutions.

‍

Two details independently strengthen the targeting picture beyond motive alone. First, the primary lure's theme is not a generic pretext: Pakistan's Ministry of Industries and Production has a real, currently active New Energy Vehicle (EV) policy process for 2025-2030, published on the ministry's own domain, so a notification about an “EV Subsidy” would read as plausible, topical correspondence to ministry staff rather than an obviously synthetic hook. Second, a 2023 analysis of SideWinder's targeting in Pakistan (Centre for Strategic and Contemporary Research) independently states that the group has “reportedly embedded itself in the Cabinet Division” and separately maintains “an updated repository of economic intelligence especially pertaining to the prized real estate sector,” a match to two of this campaign's five lure themes (Cabinet Division directly, and Defence Housing Authority as Pakistan's most prominent military-linked real-estate body) that predates this campaign and was not something we searched for to fit the conclusion.

‍

The Djibouti-themed lure follows similar logic, one level removed. Djibouti hosts one of China's largest Belt-and-Road-financed free-trade-zone and port investments in Africa alongside military bases for several foreign powers, making it a natural collection target for an actor whose sponsor has an ongoing strategic rivalry with China over Indian Ocean and Red Sea influence, consistent with the maritime-targeting pivot already cited from Securelist and Dark Reading reporting.

‍

We assess with high confidence that MoI&P EV Subsidy 2026 .doc is a malicious lure document and that elagonte[.]info is dedicated, actor-controlled phishing and staging infrastructure built for repeated use against Pakistani government and quasi-government targets. We assess with high confidence, based on the content recovered directly from the template-fetch URL, that the operator employs server-side cloaking to withhold live malicious content from requesters it does not recognize as genuine victims, which is why repeated, non-Pakistani detonation of this sample never recovered a functional second-stage payload.

‍

We further assess with high confidence that this is not an isolated incident but a single kit, identifiable by its “/ifle” delivery-path convention, deployed across at least three domains (elagonte[.]info, vagued[.]live, and, on rented rather than owned infrastructure, info-lanka[.]com), all three of which served the byte-identical lure theme (“DHA Gandhara Phase-9 Notification and Application Form.doc”) under distinct file hashes. An independent Falcon Sandbox detonation of the info-lanka[.]com sample confirms this is a mechanism-level match, not just a shared lure document: the identical OPTIONS-then-GET request sequence to a /ifle path, the same \PIPE\DAV RPC SERVICE named pipe, the same on-open “password-protected” prompt, and a decoy image dropped to the same Office template-cache location observed in Stage 3 (a different format and hash from elagonte[.]info's own cloak image). A separate artifact we attribute directly to vagued[.]live carries this exact same decoy-image hash, indicating the kit serves from a small, reused pool of decoy images rather than generating a unique one per request. vagued[.]live extends the known target set for the first time beyond Pakistan; alongside a Pakistani Ministry of Foreign Affairs lure, its subdomain list includes a likely impersonation of the Djibouti Ports and Free Zones Authority.

‍

The delivery mechanism (macro-free remote template injection), the lure theming (impersonation of specific Pakistani ministries and agencies, including Cabinet Division and now Ministry of Foreign Affairs), and the anti-analysis cloaking behavior together match a pattern publicly reported for SideWinder, an India-linked actor with a multi-year record of targeting Pakistani government and military personnel using this same combination of techniques. A 2023-11-10 Chinese-language writeup (Qi'anxin / Thousand-Li Security Technology Center) documents a SideWinder (APT-C-17 / T-APT-04) campaign against Pakistani government, diplomatic, military, and embassy-commercial targets using bilingual spear-phishing lures styled as an IMF World Economic Outlook report launch invitation. That campaign used remote template injection via DOCX documents, the same delivery mechanism observed throughout this case, and a closer technique match than the CVE-2017-11882 exploitation cited in the Djibouti/maritime reporting below, alongside WMI-based process creation for defense evasion and XOR-keyed payload obfuscation, both of which recur in the Joe Sandbox findings for the vagued[.]live sibling sample above. Its infrastructure (mailmofa[.]alit[.]info, invitation-letter[.]govpk[.]info) follows a naming logic similar to this campaign's own kit, fake-government subdomains and keywords under a generic-sounding .info domain, though none of its specific domains, IPs, or file hashes overlap with this case. This is additional technique-and-targeting corroboration, not a confirmed linkage, but it closes the delivery-mechanism gap that the Djibouti/maritime comparison below could not close on its own.

‍

The new Djibouti-themed lure strengthens this match in a different direction. Securelist and Dark Reading both document SideWinder's 2024-2025 campaigns pivoting to maritime and port-authority targets across multiple countries, including Djibouti, delivered through weaponized Office documents fetching a second-stage payload from attacker infrastructure, the same overall playbook observed here, albeit via a different specific exploitation technique (CVE-2017-11882 document exploitation in the reported campaigns, versus remote template injection in this one, as seen instead in the 2023 Pakistan-focused reporting cited above). A public any.run sandbox record independently shows a “.live”-TLD domain styled after a Djibouti port authority (notice.portdedjibouti[.]live) fetching a malicious RTF via a path reminiscent of this kit's own convention, not an IOC overlap with this case, but a notable convergence in naming and TLD choice.

‍

A separate, independent Joe Sandbox analysis of the vagued[.]live sibling sample (3b9432019a80a62fe6760a65f2677783bd60383b60206a5db7237a1b050647a2) goes a step further than technique-and-targeting comparison, its own automated YARA and network-signature detections classified the sample as associated with SideWinder directly, the first time in this investigation that a specific file hash and domain from this campaign have been tied to the named actor by an independent party, rather than by our own comparison of delivery mechanism and targeting pattern. Combined with the geopolitical and lure-theme corroboration above, we raise our confidence that this activity is attributable to SideWinder or a closely aligned operator from low-to-medium to medium-to-high.

‍

This is still short of a confirmed linkage. We have not found this campaign's specific domains, IPs, or file hashes in narrative public reporting, blog posts or named threat-actor profiles on SideWinder. The delivery technique observed here (remote template injection) differs from the CVE-2017-11882 exploitation documented in the Djibouti/maritime reporting cited above, and the Joe Sandbox report itself was reviewed through an AI-mediated extraction rather than a full manual read-through (see the caveat under the vagued[.]live section), which is the main reason we stop short of high confidence. We treat it as a well-supported working hypothesis for further pivoting rather than an established fact.

‍

Separately, three of the four Pakistan-themed samples in this campaign were independently submitted to VirusTotal directly from Pakistan, each within a day of that lure's own first-seen date (see Victim Submission Geography above). This is evidence of genuine in-region impact that does not depend on lure theming or infrastructure analysis, and it strengthens the overall targeting picture independent of the SideWinder attribution question.

‍

pncert[.]info's relationship to this campaign is better explained than it was earlier in this investigation, though still not confirmed as the same operator. Its lure document, ACTNO12024-08102024.doc, decodes to Republic Act No. 12024, the Philippines' Self-Reliant Defense Posture Revitalization Act, signed 2024-10-08, and its VirusTotal submission from the Philippines on 2024-10-15 follows that signing by one week, consistent with a deliberately timed, topical lure rather than noise. The domain name itself is a plausible stylization of PNCERT, the Philippines' own National Computer Emergency Response Team (NCERT-PH), a closer match than the Pakistan PKCERT and India NCERT candidates considered previously. We raise our confidence that this is a genuine, actor-built lure document from low to low-to-medium, while keeping separate, and still unconfirmed, the question of whether it was built and operated by the same actor as the core Pakistan/Djibouti campaign; it remains roughly 22 months removed from that campaign's documented activity window, with no shared file hash or corroborating passive DNS. We recommend a direct document-level comparison against the other four samples to help resolve this.

‍

Recommendations

1. Block and monitor the entire elagonte[.]info domain and 193[.]29[.]57[.]28 at email and web gateways, rather than only the ministry-of-industries-and-production subdomain, since the pDNS enumeration shows the whole domain is single-IP, actor-controlled infrastructure.
2. Extend the same domain-wide blocking to vagued[.]live and 195[.]54[.]160[.]145, and specifically to the defense-housing-authority[.]info-lanka[.]com subdomain and 5[.]230[.]41[.]113, while recognizing the latter IP hosts unrelated third-party traffic and should not be blocked wholesale without further review.
3. Pivot 193[.]29[.]57[.]28, 195[.]54[.]160[.]145, and the elagonte[.]info / vagued[.]live registrants through Augur's infrastructure, WHOIS, and passive DNS tooling for further sibling domains, reused registration details, or hosting overlap with other known campaigns, including public SideWinder infrastructure and the any.run-documented portdedjibouti[.]live.
4. Hunt for all five lure-document SHA256 values identified across this campaign (fb64645c7af07d59ac6037bbbf5f2e7de6502bff4235cd06897e93870c5f7b3a; fd71c8923bd8c788b6ca0a1b253ac8ac1daf47273c949134b99eae23699b80fd; 3b9432019a80a62fe6760a65f2677783bd60383b60206a5db7237a1b050647a2; 729c062a18bb7623e1aace5a9bac1fdc066dae9033a3c3a690aa2c3765bb0a61; 62836cfdcd6289c5365352822c311d631222802ea434a74fa3d9a9924432f798) and the “DHA Gandhara Phase-9”, “MoI&P EV Subsidy 2026”, and “ACTNO12024-08102024” filename patterns across email gateway and endpoint logs. Separately, hunt for the two recovered second-stage artifacts tied to vagued[.]live (the captured cloak-response document, SHA256 07cf38a134231ab9ea5ac5bcbf07bf37699919e4ca0d483b068303a22b285ff9, and the App.dll loader, SHA256 03d55a27b1ef9f4c3dffc0c590d4e095fcbb3b714f5102c0c17928f94d545d52) and for the campaign identifiers 5jxs3yszgck and TYP1S-ABCD, which may recur in infrastructure or samples outside this campaign's currently known domains.
5. Add a detection rule for the “/ifle” URL path suffix, independent of the hosting domain, as a kit-level fingerprint for this delivery mechanism, alongside the existing rule for a DAV RPC SERVICE named pipe paired with an external template reference to a newly observed or low-reputation domain.
6. Monitor elagonte[.]info and vagued[.]live for new subdomains going forward given the roughly weekly-to-biweekly cadence of new lure themes observed on each since 2026-06-24 (vagued[.]live) and 2026-08-21 (elagonte[.]info).
7. Pursue other pivots besides raw passive DNS for 185[.]53[.]179[.]146, 84[.]32[.]84[.]33, and 104[.]128[.]190[.]193, these three are understood to be heavily shared IPs hosting large numbers of unrelated domains, so a passive-DNS pull on the IP alone is expected to be as noisy as info-lanka[.]com's was and unlikely to cleanly confirm or rule out a connection by itself. WHOIS/registration overlap, TLS certificate reuse, or hosting-provider abuse contacts are more likely to be productive here than IP-level pDNS.
8. Directly compare the pncert[.]info sample (ACTNO12024-08102024.doc) against the other four at the document level (macros, OOXML relationship structure, builder/template metadata) rather than relying further on the URL path convention alone, given its VirusTotal submission from the Philippines roughly two years before this campaign's other activity casts doubt on a shared-actor relationship.

‍

For questions or additional analysis, contact: research@augursecurity.com

‍

Sources

Sandbox / detonation reports

• Joe Sandbox analysis of the vagued[.]live sibling sample (3b9432019a80a62fe6760a65f2677783bd60383b60206a5db7237a1b050647a2): https://www.joesandbox.com/joereverser/analysis/2e03ffcc-7c06-455e-bbfd-a5b7188fa521/download?type=reports&report=html
• Falcon Sandbox (Hybrid Analysis) detonation of the info-lanka[.]com sibling sample (62836cfdcd6289c5365352822c311d631222802ea434a74fa3d9a9924432f798): https://hybrid-analysis.com/sample/62836cfdcd6289c5365352822c311d631222802ea434a74fa3d9a9924432f798

SideWinder / threat-actor reporting

• Centre for Strategic and Contemporary Research, "SideWinder APT Group and Pakistan's Abysmal Response to Cyber Espionage" (2023): https://cscr.pk/explore/themes/defense-security/sidewinder-apt-group-and-pakistans-abysmal-response-to-cyber-espionage/
• Qi'anxin / Thousand-Li Security Technology Center, SideWinder (APT-C-17/T-APT-04) Pakistan writeup, 2023-11-10: https://www.ctfiot.com/144957.html
• Securelist, "SideWinder APT updates its toolset and targets nuclear sector" (H2 2024 update; cites Djibouti, Philippines, and Southeast Asia targeting): https://securelist.com/sidewinder-apt-updates-its-toolset-and-targets-nuclear-sector/115847/
• Dark Reading, "India-Linked SideWinder Group Pivots to Hacking Maritime Targets": https://www.darkreading.com/cyberattacks-data-breaches/india-linked-sidewinder-group-pivots-to-hacking-maritime-targets
• The Hacker News, "New SideWinder Cyber Attacks Target Maritime Facilities in Multiple Countries" (2024-07): https://thehackernews.com/2024/07/new-sidewinder-cyber-attacks-target.html

Republic Act No. 12024 / pncert[.]info verification

• Supreme Court E-Library (Philippines), Republic Act No. 12024 full text: https://elibrary.judiciary.gov.ph/thebookshelf/showdocs/2/97883
• LawPhil.net, Republic Act No. 12024: https://lawphil.net/statutes/repacts/ra2024/ra_12024_2024.html
• Presidential Legislative Liaison Office, signing announcement, 2024-10-08: https://www.pllo.gov.ph/index.php/gallery/gallery-2024/2024-10-08-president-ferdinand-r-marcos-jr-signed-into-law-republic-act-ra-no-12024-otherwise-known-as-the-self-reliant-defense-posture-srdp-revitalization-act
• Philstar, "Marcos signs bill making Philippines' defense more self-reliant," 2024-10-08: https://www.philstar.com/headlines/2024/10/08/2391025/marcos-signs-bill-making-philippines-defense-more-self-reliant
• GlobalSecurity.org, "Marcos signs self-reliant defense posture law," 2024-10-08: https://www.globalsecurity.org/military/library/news/2024/10/mil-241008-pna01.htm
• BGPView, ASN 151789 (Philippine National Computer Emergency Response Team): https://bgpview.io/asn/151789
• NCERT-PH (Philippines National Computer Emergency Response Team), About Us: https://www.ncert.gov.ph/about-us/

‍

Appendix - Consolidated Indicators

‍

Files

• MoI&P EV Subsidy 2026 .doc (observed filename); true type Microsoft Word 2007+ / OOXML
• SHA256: fb64645c7af07d59ac6037bbbf5f2e7de6502bff4235cd06897e93870c5f7b3a
• SHA1: 004819e96ca0316a6af7aa8931e45672d4045edd
• MD5: 29c77ef20613160d05a006732ba623e9
• Confirmed sibling lure: SHA256 fd71c8923bd8c788b6ca0a1b253ac8ac1daf47273c949134b99eae23699b80fd, “DHA Gandhara Phase-9 Notification and Application Form.doc”, contacts defence-housing-authority[.]elagonte[.]info, first seen 2026-08-25, Pakistan
• Sibling lure (vagued[.]live): SHA256 3b9432019a80a62fe6760a65f2677783bd60383b60206a5db7237a1b050647a2, same filename as above, contacts defense-housing-authority[.]vagued[.]live
• Lower-confidence related sample (pncert[.]info): SHA256 729c062a18bb7623e1aace5a9bac1fdc066dae9033a3c3a690aa2c3765bb0a61, “ACTNO12024-08102024.doc”, contacts regulations[.]pncert[.]info
• Sibling lure (info-lanka[.]com, via third-party Falcon Sandbox detonation): SHA256 62836cfdcd6289c5365352822c311d631222802ea434a74fa3d9a9924432f798, same filename as the elagonte[.]info and vagued[.]live siblings, contacts defense-housing-authority[.]info-lanka[.]com
• Decoy cloak image recovered from the info-lanka[.]com detonation (analogous to the Stage 3 embedded PNG, confirming the same anti-analysis behavior on a second domain): 9A098678.jpeg, SHA256 b96f480f71819a1e0028b2bc700434745f60132555ce14802f8c70127c23216c
• Captured template-fetch response (anti-analysis cloak): SHA256 76cd5b435d5adc9349fa605c393105a9a825fdfeac5d577793c1d4615ca17dad (HTML), with embedded PNG SHA256 f401bc1e866d3d8a2c8e7c414f723c04b51211ef46e21353a200a47551fbc865
• Captured template-fetch response (anti-analysis cloak, attributed to vagued[.]live): SHA256 07cf38a134231ab9ea5ac5bcbf07bf37699919e4ca0d483b068303a22b285ff9 (SHA1 991e926b6010d2e21a0542411811ec8325aeeebe, MD5 2b8d9cfbf7a3bc7969936629dc6aef56): an unmodified Microsoft stock “Report” template (.docx) with its one embedded image swapped for the same decoy JPEG recovered from info-lanka[.]com (SHA256 b96f480f71819a1e0028b2bc700434745f60132555ce14802f8c70127c23216c)
• Stage-3 loader dropped by the vagued[.]live sibling sample, per Joe Sandbox: App.dll, SHA256 03d55a27b1ef9f4c3dffc0c590d4e095fcbb3b714f5102c0c17928f94d545d52, MD5 fea536c4fa5a3766f1810101431c2f07
• Actor-side tracking identifiers recovered from the same analysis: campaign key 5jxs3yszgck (shared across /data and /roxpy requests) and hard-coded campaign/victim tag TYP1S-ABCD (embedded in App.dll)

‍

Network: elagonte[.]info (dedicated, single IP)

• elagonte[.]info and all subdomains: single IP 193[.]29[.]57[.]28, Germany, actor-controlled
• ministry-of-industries-and-production[.]elagonte[.]info (path /s/d7375881/, with /ifle.dotx, /ifle.dotm, /ifle.dot variants observed; serves the anti-analysis cloak described in Stage 3)
• defence-housing-authority[.]elagonte[.]info (path /applicationform/29925140/ifle)
• cabinet-division-pak[.]elagonte[.]info and www[.]cabinet-division-pak[.]elagonte[.]info
• appoinment[.]elagonte[.]info and www[.]appoinment[.]elagonte[.]info (recurring generic lure, reused with per-target randomized subdomains)
• maldoc[.]elagonte[.]info and www[.]maldoc[.]elagonte[.]info (likely payload staging)
• meeting[.]elagonte[.]info and www[.]meeting[.]elagonte[.]info
• mail[.]elagonte[.]info, www[.]elagonte[.]info, _domainkey[.]elagonte[.]info, google[.]_domainkey[.]elagonte[.]info, selector1[.]_domainkey[.]elagonte[.]info (infrastructure and email-sending setup, DKIM for Google Workspace and Microsoft 365)
• Randomized per-target subdomains: hrvpl0a3x3qocmg4[.]appoinment, qunttxksqwm014sr[.]appoinment, oxt9ws27323djsst[.]appoinment, n95n04qzrh8xheyw[.]appoinment, ulibm3uc21sps6pj[.]cabinet-division-pak, 0y7qdsqm9cevyi2z, 9o3rs3cum1d07bdb, t8tl7shx4stq0cmo, t4uvmnwlcbijrev9, d5wc51t4z6b250s9, yqvl6y5ey1bcs78l, y81z86zqt8aqrqrp, zzqx155125ba, aq7jpethxc, rdfg (all under elagonte[.]info)

‍

Network: vagued[.]live (dedicated, single IP)

• vagued[.]live and subdomains below: single IP 195[.]54[.]160[.]145 (unrelated domains historically hosted on this IP at non-overlapping times are not listed as indicators)
• defense-housing-authority[.]vagued[.]live (path /20aa11a0_f/ifle) and defence-housing-authority[.]vagued[.]live (both spellings observed)
• mofa-gov-pk[.]vagued[.]live (Pakistan Ministry of Foreign Affairs theme)
• dpfza-gov-dj[.]vagued[.]live (likely Djibouti Ports and Free Zones Authority theme; first indication of targeting outside Pakistan)
• msofficeupdate[.]vagued[.]live and msofficeupdator[.]vagued[.]live (fake Office-update lure, reused through early September)
• Reported associated but not corroborated in passive DNS reviewed here: 185[.]53[.]179[.]146 (a heavily shared IP; see Gaps / outstanding requests)
• Captured template-fetch cloak response attributed to this domain (docProps last-modified 2026-08-05T11:29:00Z, ~5 minutes after the vagued[.]live DHA sibling's VirusTotal submission): SHA256 07cf38a134231ab9ea5ac5bcbf07bf37699919e4ca0d483b068303a22b285ff9
• Per Joe Sandbox analysis of the DHA sibling sample (3b9432019...b050647a2): /71380eac_f/data (App.dll host-fingerprint beacon), /325a541c_f/roxpy (encrypted in-memory stage-3 .NET assembly), /c9505521_f/dcy (delivers %TEMP%\file2.dot, launched by an AV-conditional method), all under defense-housing-authority[.]vagued[.]live; App.dll itself is reportedly embedded within the document's own s2_0 docVar rather than fetched over the network
• Infrastructure/scaffolding subdomains: admin, dashboard, backoffice, studio, account, client, clients, staff, api, activate, fghy and its randomized sub-labels, uy, _domainkey and k1._domainkey (all under vagued[.]live)

‍

Network: pncert[.]info (lower confidence)

• regulations[.]pncert[.]info (path /de2d5f30-notification/ifle)
• 84[.]32[.]84[.]33 and 104[.]128[.]190[.]193: no passive DNS obtained for either, both reported to be heavily shared IPs; listed as reported but unverified

‍

Related, confirmed by direct file analysis: broader App.dll loader reuse (Azerbaijan, Bangladesh)

• SHA256 85359a075affaa40b215c795a095bdb3d7a07c285e4dc8abd1b3d321ad10219b (App.dll, confirmed via PE version resource): contacts internal-advisory-azerbaijan-russia-diplomatic-crisis[.]defence-np[.]net (paths /2ec7df9e-Fwd, /b2352194-Fwd, /e8939577-Fwd); first seen (VirusTotal) Azerbaijan, 2026-04-14 12:57:54 UTC
• SHA256 c0b2bd583683b839f8cdbcf056bc87d94d7538a84b70ace1829a5c0090f8ea2c (App.dll, confirmed via PE version resource): contacts mof-portal-gov-bd[.]fetchdrive[.]org (paths /67bbd114, /c513bd48, /11ef6c6b); first seen (VirusTotal) United Kingdom, 2026-08-07 04:54:20 UTC
• Both samples: 56,320 bytes, PE32 .NET assembly, identical .NET Module Version ID (MVID) 1e0e951c-e95e-490f-ba59-f3107a8f6d97, identical PE compile timestamp 0xCA4B1D71 (decodes to the nonsensical date 2077-07-19): a strong fingerprint for the same build pipeline; worth hunting for in any other suspected sample
• Neither defence-np[.]net nor fetchdrive[.]org uses the “/ifle” path convention documented for this campaign's core kit; the tie to the vagued[.]live App.dll sample is a structural/functional match (same WMI/WebClient/Reflection API surface, same obfuscation style), not a confirmed byte-level or MVID comparison against that specific hash

‍

Supporting dropped files (benign, listed for context only)

• MoI_PEVSubsidy2026.doc.docx.LNK: SHA256 b1a38c0c7bfb9146514acdc5f261cf1559837c86579956e8d54606f4078249c2
• 82C6440B.jpeg: SHA256 8f18d7126e5ebe3b6033caa7d7a36144068948dd8d24a7f991c6b2a161204c8c

‍

‍

‍