APT SideWinder Actor Profile – Recent Attacks, Tactics, Techniques, and Procedures

APT SideWinder, also known as Rattlesnake, Razor Tiger, and T-APT-04, is a nation-state advanced persistent threat (APT) group active since at least 2012 and believed to originate from India.

Noted for targeting military, government, and strategic business entities, particularly in South Asia, SideWinder’s operational footprint has recently expanded to critical infrastructure in the Middle East and Africa.

Who is APT SideWinder?

SideWinder is distinguished by its persistent and adaptive cyber-espionage operations. The group’s primary motives revolve around intelligence gathering targeting national defense, diplomatic, financial, maritime, and nuclear sectors.

Alias Names	Suspected Country	Years Active	Focus Regions	Typical Victims
Rattlesnake, T-APT-04, Razor Tiger, APT-C-17	India	2012–Present	South Asia, Middle East, Africa, Southeast Asia	Military, Government, Maritime, Nuclear, Logistics, Telecom, Financial Institutions

Recent campaigns indicate an aggressive shift toward government, logistics, and especially maritime infrastructure in the Indian Ocean and Mediterranean Sea.

SideWinder—also tracked as APT-C-17, Razor Tiger, Rattlesnake, Baby Elephant, Leafperforator, and T-APT-04—is suspected of operating from India based on persistent focus on Pakistan, China, Nepal, Bangladesh, and other geopolitical rivals, plus linguistic and infrastructure clues.

• Primary motivation: long-term political and military intelligence gathering.
• Typical victims: defence ministries, foreign affairs departments, armed-forces e-mail systems, and, since 2024, maritime logistics operators and nuclear-power agencies.
• Infrastructure depth: more than 400 live domains and hundreds of sub-domains supporting download sites, C2 nodes, and phishing portals at any given time.

Overview of APT SideWinder

Operational Approach

SideWinder orchestrates well-planned spear-phishing campaigns, leveraging geo-fenced payloads and regionally tailored lures. Exploitation of legacy Microsoft Office vulnerabilities (notably CVE-2017-11882, CVE-2017-0199) is a hallmark of its campaigns.

The group uses sophisticated multi-stage loader delivery mechanisms, frequently deploying obfuscated JavaScript, malicious Office documents, and weaponized RTF/LNK files.

Infection Chain Diagram

A detailed diagram mapping SideWinder’s attack orchestration:

Victimology has expanded markedly since 2022, when Kaspersky logged over 1,000 SideWinder intrusions in 18 months. By 2025, the actor was simultaneously running campaigns against port authorities in Egypt, logistics firms in Djibouti, and nuclear-power regulators in South Asia.

Analyzing SideWinder’s Tactics, Techniques, and Procedures (TTPs)

SideWinder’s TTPs are mapped comprehensively to the MITRE ATT&CK framework, leveraging a mix of fileless, modular payloads, document exploitation, and C2 sophistication.

1. Initial Access

• Spear-phishing emails: Weaponized Office documents or ZIP files, tailored to individual organizations and regions, often with geofenced delivery.
• Exploitation: Remote template injection triggers embedded exploit code for CVE-2017-0199 and CVE-2017-11882, resulting in initial payload execution.

2. Execution, Persistence, and Evasion

• Multi-Stage Loaders: Obfuscated JavaScript/.NET, leveraging shellcode-based loaders to download modular implants like StealerBot and WarHawk backdoor.
• DLL Side-Loading: Hijacking legitimate system binaries for stealthy execution.
• Fileless Malware: Implants loaded directly into memory (RAM-resident) to evade disk-based detection.

3. Command and Control (C2)

• Infrastructure: 400+ domains, dynamic subdomains, HTTPS-encrypted communications, Telegram for data exfiltration, periodic infrastructure changes for detection evasion.

4. Post-Exploitation Modules

• StealerBot: Modular espionage tool providing keystroke logging, screenshot capture, credential harvesting, data exfiltration, persistent access, and secondary malware deployment.
• WarHawk Backdoor: Advanced loader with kernel-level injection, time zone checks, and dedicated modules for download/execute, command execution, and file exfiltration.

5. Lateral Movement

• Credential Harvesting: RDP, browser credentials, and access escalation to adjacent systems.
• Rapid Adaptation: SideWinder modifies malware within hours post-detection, alters file and infrastructure naming for persistence.

MITRE ATT&CK Stage	Example Techniques (IDs)	SideWinder Implementation
Initial Access	Phishing (T1566.001), Exploit Public-Facing App (T1190)	Targeted spear-phishing, document exploits
Execution	User Execution (T1204.002), Scripting (T1059.007)	Weaponized attachments, script loaders
Persistence	DLL Side-Loading (T1073), Fileless Malware (T1055.003)	Side-loaded binaries, RAM-resident implants
Defense Evasion	Obfuscated Files (T1027), Dynamic C2 (T1105)	Obfuscated payloads, rapid infrastructure changes
Credential Access	Credential Dumping (T1003), Browser Credential Theft (T1555)	StealerBot credential harvesting
Discovery	System Information Discovery (T1082), Network Discovery (T1046)	Recon modules post-compromise
Collection & Exfiltration	Data Staged (T1074), Exfiltration to C2 (T1041)	Data theft, screenshots, exfil via HTTPS/Telegram
Command and Control	Encrypted C2 (T1071.001), External Remote Services (T1133)	HTTPS/Tor, Telegram, custom protocols
Impact & Lateral Movement	Remote Services (T1021), Execution via API (T1106)	Move within network, maintain persistent espionage

---

Notable Attacks and Campaigns

Real-World Attack Examples

Year	Target/Region	Attack Vector & Payload	Outcome/Impact
2013	Indian Embassy, Kabul	Phishing with malicious DOC/RTF	Data exfiltration, diplomatic intelligence loss
2015	Pakistani Air Force	Spear-phishing, exploit chain, custom backdoor implant	Sensitive military files exfiltrated
2018	Ukrainian Military Website	Malicious script, credential harvesting via info stealer	Tactical intelligence compromised
2024	Sri Lanka CB & Govt Agencies	Geofenced spear-phishing, Office exploit to StealerBot	Persistent access, financial and government espionage
2024	Maritime Sector (Djibouti, Egypt)	Phishing, compromised documents, agile infrastructure, StealerBot, WarHawk	Strategic infrastructure mapping, logistics planning theft
2025	Pakistan Cabinet Division	ISO bundles, LNK, WarHawk backdoor, kernel injection, timezone checks	Cobalt Strike deployment, access maintained in local time zone

APT SideWinder exemplifies a modern, adaptive, and regionally effective cyber espionage threat. By continuously improving its toolkit (e.g., StealerBot, WarHawk), leveraging fileless persistence, and targeting geopolitical interests, SideWinder remains a persistent risk for government, defense, maritime, and financial sectors across Eurasia and Africa.

• Primary motivation: long-term political and military intelligence gathering.
• Typical victims: defence ministries, foreign affairs departments, armed-forces e-mail systems, and, since 2024, maritime logistics operators and nuclear-power agencies.
• Infrastructure depth: more than 400 live domains and hundreds of sub-domains supporting download sites, C2 nodes, and phishing portals at any given time.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.