Sidewinder
Threat actorAttributed to India by MITRE ATT&CK (source). An attribution, not a proven fact.
Names and who uses them
- SidewinderOur name
- RattlesnakeMITRE ATT&CK
- T-APT-04MITRE ATT&CK
Targets
Sectors: Government, Defence
Source: MITRE ATT&CKKnown techniques
- T1016System Network Configuration Discovery
- T1020Automated Exfiltration
- T1027.010Command Obfuscation
- T1027.013Encrypted/Encoded File
- T1033System Owner/User Discovery
- T1036.005Match Legitimate Resource Name or Location
- T1057Process Discovery
- T1059.001PowerShell
- T1059.005Visual Basic
- T1059.007JavaScript
- T1071.001Web Protocols
- T1074.001Local Data Staging
- T1082System Information Discovery
- T1083File and Directory Discovery
- T1105Ingress Tool Transfer
- T1119Automated Collection
- T1124System Time Discovery
- T1203Exploitation for Client Execution
- T1204.001Malicious Link
- T1204.002Malicious File
- T1218.005Mshta
- T1518Software Discovery
- T1518.001Security Software Discovery
- T1547.001Registry Run Keys / Startup Folder
- T1559.002Dynamic Data Exchange
- T1566.001Spearphishing Attachment
- T1566.002Spearphishing Link
- T1574.001DLL
- T1598.002Spearphishing Attachment
- T1598.003Spearphishing Link
Malware and tools used
Source: MITRE ATT&CKRecent news
No stories yet.