SideWinder

SideWinder is a prolific cyber-espionage threat actor active since at least 2012 and widely tracked under aliases including RattleSnake, SideWinder APT, T-APT-04, and APT-C-17. The group is commonly assessed as having an India nexus. Its operations have primarily focused on espionage against government, diplomatic, and military entities across South Asia, while later campaigns expanded into the Middle East and Africa and also targeted telecommunications, financial institutions, maritime infrastructure, logistics organizations, and entities associated with nuclear energy. SideWinder is best known for spear-phishing-led intrusion chains using malicious document attachments and archive files, including OOXML documents, DOCX files, and ZIP archives containing LNK files. The actor has repeatedly used remote template injection and exploitation of CVE-2017-11882 to trigger multistage infections. Observed execution chains have involved JavaScript and HTA stages, .NET downloaders, module installers, DLL sideloading, and in-memory loading of later-stage implants. SideWinder has also been associated with use of commodity malware such as AveMariaRAT in some operations. A defining feature of the group is its private post-exploitation toolkit StealerBot, a modular espionage implant used on selected victims. Reported StealerBot capabilities include file theft, keylogging, screenshot capture, reverse shell access, browser token theft, RDP credential theft, credential phishing, and UAC bypass. SideWinder has also used loader components referred to as Backdoor Loader and ModuleInstaller to deploy payloads, establish footholds, and tailor execution according to the victim environment. Researchers have noted that the actor rapidly retools malware components, persistence methods, and loader variants to evade detection, sometimes updating samples within hours. The group conducts extensive host reconnaissance after compromise. Documented behaviors include collection of computer name, operating system version, installed hotfixes, processor and memory details, usernames, file and directory information, network interface and MAC address data, and broader system and network configuration details. SideWinder also performs security software discovery, including use of WMI and the SecurityCenter2 namespace to identify installed antivirus products, and incorporates anti-analysis checks such as RAM thresholds and environment validation. Persistence and defense evasion are recurring elements of SideWinder tradecraft. The actor has established persistence through Registry Run keys and scheduled tasks, and has abused DLL sideloading with legitimate signed binaries. Observed evasion techniques include AMSI patching, control-flow obfuscation, selective execution based on installed security products, anti-sandbox timing checks, and victim-specific tailoring of certain loader variants for manual deployment during later intrusion stages. Command-and-control communications have used HTTP and related web-based channels. Victimology consistently indicates strategic intelligence collection aligned with regional geopolitical interests. Historically, SideWinder has targeted military and government entities in Pakistan, Sri Lanka, China, and Nepal, and later campaigns showed sustained interest in Bangladesh, Gulf states, Egypt, Djibouti, and other countries across Asia, the Middle East, and Africa. Additional targeting has included diplomatic entities and ministries, as well as telecom and financial organizations in Gulf nations. Overall, SideWinder is assessed as a long-running, adaptive espionage actor with a strong focus on government and security-related intelligence collection.