Sidewinder

APT / StateG0121 ↗
Origin🇨🇳 China
Techniques (MITRE ATT&CK)30
SourceMITRE ATT&CK
State sponsor: IndiaTarget categories: Government, Military, Private Sector
Targeted regions: China · Pakistan · Nepal · Afghanistan
Also known as:APT-C-17RattlesnakeT-APT-04

About the group

Sidewinder is a suspected Indian threat actor group that has been active since at least 2012. They have been observed targeting government, military, and business entities throughout Asia, primarily focusing on Pakistan, China, Nepal, and Afghanistan.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity57
Impact: High
T1566.001T1059.001T1547.001T1016T1074.001ENTRYInitial accessSpearphishingAttachmentEXECExecutionPowerShellPERSPersistenceRegistry Run Keys/ Startup FolderDISCDiscoverySystem NetworkConfiguration Dis…COLLCollectionLocal Data StagingEXFILExfiltrationAutomatedExfiltration

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 30

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Reconnaissance
Spearphishing AttachmentSpearphishing Link
Initial access
Spearphishing AttachmentSpearphishing Link
Execution
PowerShellVisual BasicJavaScriptExploitation for Client ExecutionMalicious LinkMalicious FileDynamic Data Exchange
Persistence
Registry Run Keys / Startup Folder
Discovery
System Network Configuration DiscoverySystem Owner/User DiscoveryProcess DiscoverySystem Information DiscoveryFile and Directory DiscoverySystem Time DiscoverySoftware DiscoverySecurity Software Discovery
Collection
Local Data StagingAutomated Collection
Command and control
Web ProtocolsIngress Tool Transfer
Exfiltration
Automated Exfiltration
stealth
Command ObfuscationEncrypted/Encoded FileMatch Legitimate Resource Name or LocationMshtaDLL

Exploited vulnerabilities 2

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2017-11882HIGHEPSS 100%KEV MITRE ATT&CK
CVE-2020-0674HIGHEPSS 87%KEV MITRE ATT&CK

Known infrastructure 3

Real indicators (C2, domains, URLs and hashes) associated with the malware this group uses. Source: abuse.ch (ThreatFox, URLhaus, MalwareBazaar).

ip:port158.51.122.136:4944Koadicthreatfox
urlhttps://178.16.52.80/hold.batKoadicurlhaus
urlhttp://178.16.52.80/hold.batKoadicurlhaus

References

Sidewinder uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →