Sidewinder

APT / StateG0121 ↗
Origin🇨🇳 China
Techniques (MITRE ATT&CK)30
SourceMITRE ATT&CK
State sponsor: IndiaTarget categories: Government, Military, Private Sector
Targeted regions: China · Pakistan · Nepal · Afghanistan
Also known as:T-APT-04Rattlesnake

Vexday analysis

Sidewinder (também rastreado como T-APT-04 e Rattlesnake, identificador MITRE ATT&CK G0121) é um grupo de ameaça persistente avançada suspeito de origem indiana, ativo desde pelo menos 2012. O grupo tem como alvos documentados entidades governamentais, militares e empresariais em toda a Ásia, com foco primário em Paquistão, China, Nepal e Afeganistão. Seu perfil técnico compreende 30 técnicas mapeadas no framework MITRE ATT&CK e 2 CVEs atribuídas ao seu arsenal de exploração.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity57
Impact: High
T1566.001T1059.001T1547.001T1016T1074.001ENTRYInitial accessSpearphishingAttachmentEXECExecutionPowerShellPERSPersistenceRegistry Run Keys/ Startup FolderDISCDiscoverySystem NetworkConfiguration Dis…COLLCollectionLocal Data StagingEXFILExfiltrationAutomatedExfiltration

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 30

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Reconnaissance
Spearphishing AttachmentSpearphishing Link
Initial access
Spearphishing AttachmentSpearphishing Link
Execution
PowerShellVisual BasicJavaScriptExploitation for Client ExecutionMalicious LinkMalicious FileDynamic Data Exchange
Persistence
Registry Run Keys / Startup Folder
Discovery
System Network Configuration DiscoverySystem Owner/User DiscoveryProcess DiscoverySystem Information DiscoveryFile and Directory DiscoverySystem Time DiscoverySoftware DiscoverySecurity Software Discovery
Collection
Local Data StagingAutomated Collection
Command and control
Web ProtocolsIngress Tool Transfer
Exfiltration
Automated Exfiltration
stealth
Command ObfuscationEncrypted/Encoded FileMatch Legitimate Resource Name or LocationMshtaDLL

Exploited vulnerabilities 2

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2017-11882HIGHEPSS 100%KEVCVE-2020-0674HIGHEPSS 87%KEV

Known infrastructure 2

Real indicators (C2, domains, URLs and hashes) associated with the malware this group uses. Source: abuse.ch (ThreatFox, URLhaus, MalwareBazaar).

urlhttps://178.16.52.80/hold.batKoadicurlhaus
urlhttp://178.16.52.80/hold.batKoadicurlhaus

References

Sidewinder uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →