SideWinder

SideWinder is a highly prolific espionage APT group active since at least 2012. It is also known as RattleSnake, Razor Tiger, and T-APT-04. The group has historically targeted government and military entities, particularly in Pakistan, Sri Lanka, China, and Nepal, and reporting in the provided content also describes targeting of business entities primarily throughout Asia. More recent activity expanded to diplomatic entities, maritime infrastructure, logistics companies, and organizations linked to nuclear energy across South and Southeast Asia, the Middle East, and Africa, with victims and targeting noted in countries including Bangladesh, Djibouti, Jordan, Malaysia, the Maldives, Myanmar, Nepal, Pakistan, Saudi Arabia, Sri Lanka, Turkey, the United Arab Emirates, and diplomatic entities in Afghanistan, France, China, India, Indonesia, and Morocco. The group primarily uses spear-phishing emails with malicious attachments to gain initial access. Observed lures include DOCX/OOXML documents and ZIP archives containing malicious LNK files, often crafted for specific targets. The documents use remote template injection to retrieve attacker-hosted RTF files that exploit CVE-2017-11882, leading to multistage execution involving mshtml RunHTMLApplication, mshta, obfuscated JavaScript, and PowerShell-based loader execution. SideWinder has also used JavaScript and PowerShell to drop and execute malware loaders. Post-compromise, SideWinder has conducted broad host reconnaissance and collection. Reported behaviors include collecting information on files and directories, staging stolen files in temporary folders for exfiltration, identifying running processes, collecting system and network configuration information, identifying the user of a compromised host, collecting computer name, OS version, installed hotfixes, memory and processor details, and collecting network interface information including MAC addresses. The group has used HTTP in command-and-control communications and has used Base64 encoding and ECDH-P256 encryption for payloads. Persistence and evasion behaviors in the content include adding executable paths to the Registry, naming malicious files rekeywiz.exe to resemble a legitimate Windows executable, anti-analysis checks, AMSI patching, DLL sideloading, and selective execution based on installed security products. The provided reporting describes SideWinder’s malware ecosystem as including a .NET Downloader Module, ModuleInstaller, Backdoor Loader, and the in-memory StealerBot post-exploitation toolkit. StealerBot is described as a modular espionage implant with plugins for keylogging, screenshots, file theft, reverse shell/live console access, browser token theft, RDP credential theft, credential phishing, and UAC bypass. Backdoor Loader variants and a C++ Backdoor Loader were also observed, with some C++ samples assessed as tailored to specific victims and likely manually deployed after initial compromise. The content attributes SideWinder as an India-linked espionage group in one report focused on China-related threats, but the provided material does not state a definitive government attribution beyond that phrasing.