MITRE ATT&CKgroup

G0121 Sidewinder

Published 2021-01-27 Modified 2026-07-31 Official page ↗
Domain
enterprise
Aliases
T-APT-04, Rattlesnake
Version
1.2
Created
2021-01-27

Description

Sidewinder is a suspected Indian threat actor group that has been active since at least 2012. They have been observed targeting government, military, and business entities throughout Asia, primarily focusing on Pakistan, China, Nepal, and Afghanistan.

Related

Uses · MITRE ATT&CK (31)

  • T1027.013 Encrypted/Encoded File sub-technique
  • T1027.010 Command Obfuscation sub-technique
  • T1598.002 Spearphishing Attachment sub-technique
  • T1598.003 Spearphishing Link sub-technique
  • T1059.007 JavaScript sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1074.001 Local Data Staging sub-technique
  • T1574.001 DLL sub-technique
  • T1204.001 Malicious Link sub-technique
  • T1204.002 Malicious File sub-technique
  • T1059.001 PowerShell sub-technique
  • T1059.005 Visual Basic sub-technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1566.002 Spearphishing Link sub-technique
  • T1518.001 Security Software Discovery sub-technique
  • T1559.002 Dynamic Data Exchange sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1218.005 Mshta sub-technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique
  • T1518 Software Discovery technique
  • S0250 Koadic software (tool)
  • T1203 Exploitation for Client Execution technique
  • T1016 System Network Configuration Discovery technique
  • T1020 Automated Exfiltration technique
  • T1033 System Owner/User Discovery technique
  • T1057 Process Discovery technique
  • T1082 System Information Discovery technique
  • T1083 File and Directory Discovery technique
  • T1105 Ingress Tool Transfer technique
  • T1119 Automated Collection technique
Show all 31 ›

References