Introduction
Sidewinder is a suspected Indian threat actor group that has been active since at least 2012. They have been observed targeting government, military, and business entities throughout Asia, primarily focusing on Pakistan, China, Nepal, and Afghanistan. ATT Sidewinder January 2021 Securelist APT Trends April 2018 Cyble Sidewinder September 2020
Activities and Tactics
Information pending cataloguing.
Notable Campaigns
Information pending cataloguing.
Tactics, Techniques, and Procedures (TTPs)
- T1203 Exploitation for Client Execution
- T1518.001 Security Software Discovery
- T1218.005 Mshta
- T1598.003 Spearphishing Link
- T1124 System Time Discovery
- T1566.002 Spearphishing Link
- T1074.001 Local Data Staging
- T1057 Process Discovery
- T1059.007 JavaScript
- T1027.013 Encrypted/Encoded File
- T1020 Automated Exfiltration
- T1105 Ingress Tool Transfer
- T1547.001 Registry Run Keys / Startup Folder
- T1071.001 Web Protocols
- T1559.002 Dynamic Data Exchange
- T1083 File and Directory Discovery
- T1016 System Network Configuration Discovery
- T1598.002 Spearphishing Attachment
- T1027.010 Command Obfuscation
- T1059.001 PowerShell
- T1518 Software Discovery
- T1059.005 Visual Basic
- T1082 System Information Discovery
- T1119 Automated Collection
- T1566.001 Spearphishing Attachment
- T1036.005 Match Legitimate Resource Name or Location
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1033 System Owner/User Discovery
- T1574.001 DLL
ATT&CK technique IDs (denormalized)
- T1016
- T1020
- T1027.010
- T1027.013
- T1033
- T1036.005
- T1057
- T1059.001
- T1059.005
- T1059.007
- T1071.001
- T1074.001
- T1082
- T1083
- T1105
- T1119
- T1124
- T1203
- T1204.001
- T1204.002
- T1218.005
- T1518
- T1518.001
- T1547.001
- T1559.002
- T1566.001
- T1566.002
- T1574.001
- T1598.002
- T1598.003
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
MITRE ATT&CK Software
Attribution and Evidence
Information pending cataloguing.
References
[1] mitre-attack [4] Cyble Sidewinder September 2020 Cyble. (2020, September 26). SideWinder APT Targets with futuristic Tactics and Techniques. Retrieved January 29, 2021. [5] Securelist APT Trends April 2018 Global Research and Analysis Team . (2018, April 12). APT Trends report Q1 2018. Retrieved January 27, 2021. [6] ATT Sidewinder January 2021 Hegel, T. (2021, January 13). A Global Perspective of the SideWinder APT. Retrieved January 27, 2021.