Threat actor
SideWinder
India
Tracked by CyberSIXT since 12 Sep 2025
- Articles · all time
- 8
- Articles · last 30 days
- 0
- CVEs exploited · attributed · all time
- 0
- Research reports · all time
- 0
8 articles from 4 outlets since 12 Sep 2025; the latest 221 days ago.
- Article
Show as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 18 Mar · 13:08 UTC | Dark Reading | SideWinder Espionage Campaign Expands Across Southeast Asia |
| Tue 28 Oct 2025 · 04:35 UTC | The Hacker News | SideWinder Adopts New ClickOnce-Based Attack Chain Targeting South Asian Diplomats |
| Tue 28 Oct 2025 · 02:20 UTC | SecurityOnline | SideWinder APT Shifts to PDF/ClickOnce Chain to Target South Asian Diplomacy with StealerBot |
| Thu 23 Oct 2025 · 08:27 UTC | GBHackers | SideWinder Leverages ClickOnce Installer to Deliver StealerBot Malware |
| Tue 7 Oct 2025 · 01:26 UTC | SecurityOnline | SideWinder APT Launches Operation SouthNet, Weaponizing Netlify and Pages.dev for Espionage |
| Fri 3 Oct 2025 · 10:50 UTC | GBHackers | SideWinder Hacker Group Targets Users with Fake Outlook/Zimbra Portals to Steal Login Credentials |
| Mon 15 Sep 2025 · 13:40 UTC | GBHackers | Sidewinder Hackers Weaponize Nepal Protests to Spread Cross-Platform Malware |
| Fri 12 Sep 2025 · 09:05 UTC | GBHackers | Sidewinder Hackers Exploit LNK Files to Deploy Malicious Scripts |
Who reported 4 outlets
- GBHackers4
- SecurityOnline2
- The Hacker News1
- Dark Reading1
Names and sources
- RAZOR TIGER
- Named by CyberSIXT coverage
- APT-C-17
- Named by Malpedia · razor_tiger
- RAZOR TIGER
- Named by Malpedia · razor_tiger
- Rattlesnake
- Named by Malpedia · razor_tiger
- SideWinder
- Named by Malpedia · razor_tiger
- T-APT-04
- Named by Malpedia · razor_tiger
- APT-C-17
- Named by MISP Galaxy · c4ce1174-9462-47e9-8038-794f40a184b3
- RAZOR TIGER
- Named by MISP Galaxy · c4ce1174-9462-47e9-8038-794f40a184b3
All 17 names
- Rattlesnake
- Named by MISP Galaxy · c4ce1174-9462-47e9-8038-794f40a184b3
- SideWinder
- Named by MISP Galaxy · c4ce1174-9462-47e9-8038-794f40a184b3
- T-APT-04
- Named by MISP Galaxy · c4ce1174-9462-47e9-8038-794f40a184b3
- Rattlesnake
- Named by MITRE ATT&CK® · G0121
- Sidewinder
- Named by MITRE ATT&CK® · G0121
- T-APT-04
- Named by MITRE ATT&CK® · G0121
- APT SideWinder
- Named by CyberSIXT coverage
- SideWinder APT
- Named by CyberSIXT coverage
- c4ce1174-9462-47e9-8038-794f40a184b3
- Named by CyberSIXT coverage
Attributed facts
- origin
- India (MISP Galaxy · c4ce1174-9462-47e9-8038-794f40a184b3)
- sector
- Government (MISP Galaxy · c4ce1174-9462-47e9-8038-794f40a184b3)
- sector
- Military (MISP Galaxy · c4ce1174-9462-47e9-8038-794f40a184b3)
- sector
- Private Sector (MISP Galaxy · c4ce1174-9462-47e9-8038-794f40a184b3)
- sponsor
- India (MISP Galaxy · c4ce1174-9462-47e9-8038-794f40a184b3)
- Target country
- Afghanistan (MISP Galaxy · c4ce1174-9462-47e9-8038-794f40a184b3)
- Target country
- China (MISP Galaxy · c4ce1174-9462-47e9-8038-794f40a184b3)
- Target country
- Nepal (MISP Galaxy · c4ce1174-9462-47e9-8038-794f40a184b3)
- Target country
- Pakistan (MISP Galaxy · c4ce1174-9462-47e9-8038-794f40a184b3)
Malware and tools
MITRE ATT&CK® techniques
From MITRE ATT&CK® · G0121
Tactics pending refresh
- T1016
- System Network Configuration Discovery
- T1020
- Automated Exfiltration
- T1027.010
- Command Obfuscation
- T1027.013
- Encrypted/Encoded File
- T1033
- System Owner/User Discovery
- T1036.005
- Match Legitimate Resource Name or Location
- T1057
- Process Discovery
- T1059.001
- PowerShell
- T1059.005
- Visual Basic
- T1059.007
- JavaScript
- T1071.001
- Web Protocols
- T1074.001
- Local Data Staging
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK
- SideWinder Espionage Campaign Expands Across Southeast AsiaDark Reading
- SideWinder Adopts New ClickOnce-Based Attack Chain Targeting South Asian DiplomatsThe Hacker News
- SideWinder APT Shifts to PDF/ClickOnce Chain to Target South Asian Diplomacy with StealerBotSecurityOnline
- SideWinder Leverages ClickOnce Installer to Deliver StealerBot MalwareGBHackers
- SideWinder APT Launches Operation SouthNet, Weaponizing Netlify and Pages.dev for EspionageSecurityOnline
- SideWinder Hacker Group Targets Users with Fake Outlook/Zimbra Portals to Steal Login CredentialsGBHackers
- Sidewinder Hackers Weaponize Nepal Protests to Spread Cross-Platform MalwareGBHackers
- Sidewinder Hackers Exploit LNK Files to Deploy Malicious ScriptsGBHackers · first in our coverage