Skip to content

Sidewinder

Sidewinder is a suspected Indian threat actor group that has been active since at least 2012. They have been observed targeting government, military, and business entities throughout Asia, primarily focusing on Pakistan, China, Nepal, and Afghanistan.

ATT&CK ID: G0121
Origin: India
Techniques: 23
Tools: 1

Also tracked as T-APT-04 · Rattlesnake

Vulnerabilities it has exploited

Techniques

Reconnaissance

Phishing for Information

Initial Access

Execution

Command and Scripting Interpreter Exploitation for Client Execution User Execution Inter-Process Communication Hijack Execution Flow

Persistence

Boot or Logon Autostart Execution

Privilege Escalation

Boot or Logon Autostart Execution

Stealth

Obfuscated Files or Information Masquerading System Binary Proxy Execution Hijack Execution Flow

Discovery

System Network Configuration Discovery System Owner/User Discovery Process Discovery System Information Discovery File and Directory Discovery System Time Discovery Software Discovery

Collection

Data Staged Automated Collection

Command and Control

Application Layer Protocol Ingress Tool Transfer

Exfiltration

Automated Exfiltration

Software

Koadic

MITRE ATT&CK All threat actors