← All Threat Actors
Threat Actor Profile

Sidewinder

APT-C-24 APT-Q-39 Baby Elephant G0121 Hardcore Nationalist Leafperforator Operation Origami Rattlesnake Razor Tiger SHROUDED#OOZE T-APT-04
▲ High Threat
[Sidewinder](https://attack.mitre.org/groups/G0121) is a suspected Indian threat actor group that has been active since at least 2012. They have been observed targeting government, military, and business entities throughout Asia, primarily focusing on Pakistan, China, Nepal, and Afghanistan.(Citation: ATT Sidewinder January 2021)(Citation: Securelist APT Trends April 2018)(Citation: Cyble Sidewinder September 2020)
Origin

Known TTPs

Exploitation for Client Execution
Security Software Discovery
Mshta
Spearphishing Link
System Time Discovery
Spearphishing Link
Local Data Staging
Process Discovery
JavaScript
Encrypted/Encoded File
Automated Exfiltration
Ingress Tool Transfer
Registry Run Keys / Startup Folder
Web Protocols
Dynamic Data Exchange
File and Directory Discovery
System Network Configuration Discovery
Spearphishing Attachment
Command Obfuscation
PowerShell
Software Discovery
Visual Basic
System Information Discovery
Automated Collection
Spearphishing Attachment
Match Legitimate Resource Name or Location
Malicious Link
Malicious File
System Owner/User Discovery
DLL

External Resources

CISA Advisories ↗

Related Intelligence

Hacking the mainframe…

LINK COPIED TO CLIPBOARD