“In this campaign, the SideWinder advanced persistent threat (APT) group used a server-based polymorphism technique to deliver the next stage payload,” the BlackBerry Research and Intelligence Team said in a technical report published Monday.