Sidewinder

APT / StateG0121 ↗
OriginChina
Techniques (MITRE ATT&CK)30
SourceMITRE ATT&CK
Also known as:T-APT-04Rattlesnake

Vexday analysis

Sidewinder (também rastreado como T-APT-04 e Rattlesnake, identificador MITRE ATT&CK G0121) é um grupo de ameaça persistente avançada suspeito de origem indiana, ativo desde pelo menos 2012. O grupo tem como alvos documentados entidades governamentais, militares e empresariais em toda a Ásia, com foco primário em Paquistão, China, Nepal e Afeganistão. Seu perfil técnico compreende 30 técnicas mapeadas no framework MITRE ATT&CK e 2 CVEs atribuídas ao seu arsenal de exploração.

Techniques (MITRE ATT&CK) 30

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Reconnaissance
Spearphishing AttachmentSpearphishing Link
Initial access
Spearphishing AttachmentSpearphishing Link
Execution
PowerShellVisual BasicJavaScriptExploitation for Client ExecutionMalicious LinkMalicious FileDynamic Data Exchange
Persistence
Registry Run Keys / Startup Folder
Discovery
System Network Configuration DiscoverySystem Owner/User DiscoveryProcess DiscoverySystem Information DiscoveryFile and Directory DiscoverySystem Time DiscoverySoftware DiscoverySecurity Software Discovery
Collection
Local Data StagingAutomated Collection
Command and control
Web ProtocolsIngress Tool Transfer
Exfiltration
Automated Exfiltration
stealth
Command ObfuscationEncrypted/Encoded FileMatch Legitimate Resource Name or LocationMshtaDLL

Exploited vulnerabilities 2

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2017-11882HIGHEPSS 100%KEVCVE-2020-0674HIGHEPSS 87%KEV

Sidewinder uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →