Sidewinder is a suspected Indian threat actor group that has been active since at least 2012. They have been observed targeting government, military, and business entities throughout Asia, primarily focusing on Pakistan, China, Nepal, and Afghanistan.123
- ATT Sidewinder January 2021
- Securelist APT Trends April 2018
- Cyble Sidewinder September 2020
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| uses_technique | tech_t1203 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1518.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.005 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1598.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1124 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.002 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.007 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.013 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1020 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1559.002 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1598.002 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.010 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1518 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1119 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1033 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1574.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1016 | System Network Configuration Discovery | — |
| T1020 | Automated Exfiltration | — |
| T1027.010 | Command Obfuscation | — |
| T1027.013 | Encrypted/Encoded File | — |
| T1033 | System Owner/User Discovery | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1057 | Process Discovery | — |
| T1059.001 | PowerShell | — |
| T1059.005 | Visual Basic | — |
| T1059.007 | JavaScript | — |
| T1071.001 | Web Protocols | — |
| T1074.001 | Local Data Staging | — |
| T1082 | System Information Discovery | — |
| T1083 | File and Directory Discovery | — |
| T1105 | Ingress Tool Transfer | — |
| T1119 | Automated Collection | — |
| T1124 | System Time Discovery | — |
| T1203 | Exploitation for Client Execution | — |
| T1204.001 | Malicious Link | — |
| T1204.002 | Malicious File | — |
| T1218.005 | Mshta | — |
| T1518 | Software Discovery | — |
| T1518.001 | Security Software Discovery | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1559.002 | Dynamic Data Exchange | — |
| T1566.001 | Spearphishing Attachment | — |
| T1566.002 | Spearphishing Link | — |
| T1574.001 | DLL | — |
| T1598.002 | Spearphishing Attachment | — |
| T1598.003 | Spearphishing Link | — |
Aliases
Rattlesnake · Sidewinder · T-APT-04 · 响尾蛇
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.