sidewinder-rattlesnake

• SKILL.mdcore · 22,078 bytes

# SideWinder (Rattlesnake, T-APT-04, Razor Tiger) — Adversary Emulation Profile

SideWinder (MITRE ATT&CK **G0121**) is a suspected Indian state-sponsored cyber-espionage group active since at least **2012**. It is one of the most prolific APT actors in the South Asian threat landscape, with over 1,000 documented attacks against government organizations in the Asia-Pacific region since April 2020 alone. SideWinder is characterized by rapid malware iteration (generating modified variants in under five hours after detection), heavy reliance on spearphishing with government/military-themed lures, exploitation of the aged CVE-2017-11882 Equation Editor vulnerability, multi-stage JavaScript and .NET infection chains, and custom post-exploitation tooling — most notably the modular **StealerBot** implant discovered in 2024. The group maintains a massive infrastructure footprint (400+ live domains with hundreds of sub-domains mimicking legitimate government sites) and has progressively expanded from its traditional Pakistan-centric targeting to maritime, logistics, nuclear, and diplomatic entities across the Middle East, Africa, and Southeast Asia.

## Attribution & motivation

- **Sponsor / nation:** India (suspected). Multiple threat intelligence vendors (Kaspersky GReAT, Group-IB, AT&T Alien Labs, Trend Micro, Zscaler ThreatLabz) assess SideWinder as an Indian state-sponsored group based on targeting patterns, infrastructure analysis, and victimology aligned with Indian strategic interests.
- **Motivation:** Primarily **strategic intelligence collection (espionage)** — military, government, and diplomatic intelligence from neighboring adversary states (especially Pakistan). Secondary interests include monitoring political developments in Nepal, Bangladesh, Sri Lanka, Afghanistan, and China, and — since 2024 — collecting intelligence on maritime logistics, energy, and nuclear power infrastructure.
- **Attribution confidence:** **Moderate-High.** No formal government attribution exists, but consistent and convergent vendor reporting (Kaspersky, Group-IB, Trend Micro, AT&T Alien Labs, Zscaler, Cyble) over a decade, combined with Pakistan government espionage advisories (NTISB 2019), support the Indian nexus assessment.

## Targeting

- **Sectors:** Government and military (primary); diplomatic missions and foreign affairs ministries; defense organizations; central banks and financial institutions; maritime infrastructure and logistics companies; nuclear power agencies; telecommunications; universities; energy and oil trading; media.
- **Regions:** Pakistan (primary, ongoing since 2012), China, Nepal, Bangladesh, Sri Lanka, Afghanistan, Myanmar, Bhutan — expanding to Turkey, Middle East (Saudi Arabia, UAE, Jordan, Egypt), Africa (Djibouti, Morocco, Algeria, Rwanda, Uganda), Southeast Asia (Cambodia, Vietnam, Malaysia, Maldives), and diplomatic entities in Bulgaria and India.