{ "name": "Adversary Atlas API", "version": "1.0.0", "description": "Read-only JSON API over the Adversary Atlas threat actor dataset. Statically generated at build time; no authentication, no rate limits.", "generated": "2026-07-31T01:06:07.226Z", "datasetCurrentAsOf": "2025-09-01", "license": "Data compiled from public primary sources; see /methodology/ for sourcing.", "actor": { "id": "sidewinder", "slug": "sidewinder", "name": "SideWinder", "shortName": "SideWinder", "country": "India", "countryCode": "IN", "sponsorship": "state-sponsored", "status": "active", "activeSince": "2012", "prominence": 68, "mitreGroupId": "G0121", "malpediaSlug": "sidewinder", "tagline": "One of the highest-volume phishing operations in Asia, aimed at Pakistani and Chinese government targets — and increasingly at maritime shipping.", "bio": "SideWinder runs one of the highest-volume spearphishing operations tracked anywhere, aimed primarily at Pakistani military and government targets, with secondary collection against Chinese, Nepalese, Sri Lankan, and Afghan entities.\n\nIts scale is its defining feature. Researchers have documented thousands of malicious domains and hundreds of distinct phishing campaigns, with new infrastructure registered continuously. The group operates on the assumption that most of its infrastructure will be identified and burned, and simply rebuilds faster than defenders can enumerate.\n\nThe toolchain is consistent: a malicious document exploiting an old but still-effective Office vulnerability, a JavaScript or .NET loader, and a modular implant that fingerprints the host before delivering the final payload. That fingerprinting step matters — it lets the group avoid delivering its real capability to sandboxes and researchers, and is a significant reason its later-stage tooling took years to document properly.\n\nSince 2024 the group has expanded into maritime targets — port authorities, shipping companies, and logistics operators across South and Southeast Asia and the Mediterranean — a shift consistent with growing interest in Indian Ocean shipping and regional trade routes.", "attribution": { "sponsor": "India", "service": "Indian state interests (specific service not publicly designated)", "confidence": "moderate", "summary": "Assessed as aligned with Indian state interests based on targeting focused on Pakistan, China, and neighbouring states, infrastructure and language artifacts, and operational timing. The assessment is held with moderate confidence across the industry — attribution to India rests on targeting logic more than on hard technical or legal evidence. No government attribution or indictment exists.", "sources": [ { "org": "Kaspersky GReAT", "title": "SideWinder targets ports and maritime facilities in the Mediterranean Sea and Indian Ocean", "url": "https://securelist.com/sidewinder-apt-updates-its-toolset/113930/", "date": "2024-10-15" }, { "org": "Group-IB", "title": "SideWinder: Nuclear energy sector and maritime targeting in South Asia", "url": "https://www.group-ib.com/blog/sidewinder-apt/", "date": "2025-03-13" } ] }, "motivations": [ "espionage" ], "targetSectors": [ "Government", "Defense", "Maritime", "Transportation", "Nuclear", "Education", "Energy", "Telecommunications" ], "targetCountries": [ "Pakistan", "China", "Nepal", "Sri Lanka", "Afghanistan", "Bangladesh", "Maldives", "Egypt", "Djibouti" ], "aliases": [ { "org": "mitre", "name": "SideWinder", "url": "https://attack.mitre.org/groups/G0121/", "correlation": "exact" }, { "org": "kaspersky", "name": "SideWinder", "correlation": "exact" }, { "org": "trendmicro", "name": "Rattlesnake", "correlation": "exact" }, { "org": "secureworks", "name": "TIN BAROMETER", "correlation": "exact" }, { "org": "crowdstrike", "name": "Razor Tiger", "correlation": "exact" }, { "org": "microsoft", "name": "Storm-0343", "correlation": "partial", "note": "Provisional designator for overlapping activity" }, { "org": "cisa", "name": "SideWinder", "correlation": "exact" }, { "org": "recordedfuture", "name": "APT-C-17", "correlation": "exact", "note": "Qihoo 360 designator widely cross-referenced" } ], "tools": [ { "name": "StealerBot", "type": "malware", "custom": true, "description": "Modular post-exploitation toolkit for credential theft, screenshots, keylogging, and file exfiltration, loaded entirely in memory." }, { "name": "SideWinder .NET loaders", "type": "loader", "custom": true, "description": "Multi-stage loaders that fingerprint the host and refuse to deliver later stages to sandboxes and analysis environments." }, { "name": "Remote template injection", "type": "utility", "custom": false, "description": "Documents fetching weaponised remote templates only when opened by intended targets." }, { "name": "Android implants", "type": "malware", "custom": true, "description": "Mobile malware distributed through fake applications aimed at government and military personnel." }, { "name": "Mass domain infrastructure", "type": "utility", "custom": false, "description": "Thousands of registered domains impersonating government, military, and webmail portals across target countries." } ], "techniques": [ { "tCode": "T1566.001", "name": "Phishing: Spearphishing Attachment", "tactic": "Initial Access", "note": "Very high volume, government and military document lures" }, { "tCode": "T1221", "name": "Template Injection", "tactic": "Defense Evasion" }, { "tCode": "T1203", "name": "Exploitation for Client Execution", "tactic": "Execution" }, { "tCode": "T1497.001", "name": "Virtualization/Sandbox Evasion: System Checks", "tactic": "Defense Evasion", "note": "Host fingerprinting before later-stage delivery" }, { "tCode": "T1620", "name": "Reflective Code Loading", "tactic": "Defense Evasion", "note": "In-memory .NET assembly loading" }, { "tCode": "T1583.001", "name": "Acquire Infrastructure: Domains", "tactic": "Resource Development", "note": "Thousands of domains impersonating government and webmail portals" }, { "tCode": "T1056.001", "name": "Input Capture: Keylogging", "tactic": "Collection" }, { "tCode": "T1005", "name": "Data from Local System", "tactic": "Collection" }, { "tCode": "T1071.001", "name": "Application Layer Protocol: Web Protocols", "tactic": "Command and Control" } ], "cves": [ { "cveId": "CVE-2017-11882", "firstExploited": "2018-01-01", "usage": "Equation Editor overflow — the group's most persistent delivery mechanism, used across hundreds of campaigns.", "source": { "org": "Kaspersky GReAT", "title": "SideWinder APT updates its toolset", "url": "https://securelist.com/sidewinder-apt-updates-its-toolset/113930/", "date": "2024-10-15" } }, { "cveId": "CVE-2023-38831", "firstExploited": "2023-11-01", "usage": "WinRAR archive spoofing used to deliver loaders to government targets.", "source": { "org": "Group-IB", "title": "SideWinder campaign analysis", "url": "https://www.group-ib.com/blog/sidewinder-apt/", "date": "2025-03-13" } }, { "cveId": "CVE-2017-0199", "firstExploited": "2019-01-01", "usage": "OLE2link RTF exploit used to fetch remote payloads in phishing campaigns.", "source": { "org": "Trend Micro", "title": "Rattlesnake campaign tracking", "url": "https://www.trendmicro.com/en_us/research.html", "date": "2020-06-01" } } ], "relationships": [ { "relatedActorId": "apt36", "type": "operational-overlap", "confidence": "moderate", "note": "Direct regional adversaries operating against each other's sponsoring states." } ], "reports": [ { "org": "Kaspersky GReAT", "title": "SideWinder targets ports and maritime facilities in the Mediterranean and Indian Ocean", "url": "https://securelist.com/sidewinder-apt-updates-its-toolset/113930/", "date": "2024-10-15" }, { "org": "Group-IB", "title": "SideWinder: Nuclear energy and maritime targeting in South Asia", "url": "https://www.group-ib.com/blog/sidewinder-apt/", "date": "2025-03-13" } ], "campaigns": [], "flag": "🇮🇳", "profile": "/apt/sidewinder/" } }