The SideWinder APT group has been observed deploying expanded attacks, utilizing a sophisticated multi-stage infection chain. The attack sequence begins with spear-phishing emails, delivering malicious LNK files within ZIP archives or Office documents. These files initiate a chain reaction, deploying JavaScript malware and a Backdoor loader module, ultimately leading to the deployment of the StealerBot payload. This payload is designed to steal sensitive information from compromised systems.