SideWinder is one of the most prolific espionage groups in South Asia, and since 2024 it has pushed well beyond its old targets into ports, maritime and logistics firms, nuclear energy organisations and foreign ministries across the Middle East and Africa. It still relies on a single 2017 Office flaw, CVE-2017-11882, but behind that cheap entry sits a private in-memory toolkit, StealerBot, that steals browser tokens, RDP credentials and Windows passwords. This profile is for SOC analysts, email and endpoint engineers and intelligence teams in government, defence, maritime, energy and diplomatic organisations. It covers names and attribution as each source states them, targeting, the ATT&CK techniques mapped to the group, its credential theft, notable campaigns and a detection and hardening plan. General group background is in the Threat Actor Groups Guide; sector context is in the Maritime Cybersecurity Guide.
Key takeaways
- One old exploit, used relentlessly. Kaspersky, BlackBerry and AT&T Alien Labs all describe DOCX files using remote template injection to pull an RTF that exploits CVE-2017-11882 (Equation Editor). Patching Office closes the door the group uses most.
- Targeting widened sharply in 2024. Kaspersky reports a notable rise in attacks on maritime and logistics companies and some targeting of nuclear energy organisations in South Asia, with victims from Djibouti and Egypt to Vietnam.
- StealerBot is a credential machine. It takes browser passwords, Chrome cookies and Google, Facebook and LinkedIn tokens, hooks mstsc.exe for RDP credentials and shows a fake Windows prompt until a valid password is typed.
- It adapts within hours. Kaspersky says the group updates tools quickly after detections, sometimes within hours, so indicator lists age fast.
- Behaviour detection beats indicators. mshta.exe from Office or LNK files, DLL side-loading from user folders and AMSI tampering are stable signals across campaigns.
Who they are (names and aliases)
MITRE ATT&CK tracks the group as Sidewinder (G0121), a suspected Indian threat actor group active since at least 2012, targeting government, military and business entities throughout Asia and primarily focusing on Pakistan, China, Nepal and Afghanistan. AT&T Alien Labs assessed in January 2021, with low to medium confidence, that the group operates in support of India's political interests, and reported that Pakistan's NTISB first publicly attributed it to an Indian APT in a November 2019 advisory. BlackBerry describes SideWinder as a nation-state actor believed to originate from India. Kaspersky's 2024 and 2025 reports attribute campaigns to SideWinder without naming a state sponsor.
| Name | Tracked by | Notes |
|---|---|---|
| SideWinder | Kaspersky (named 2018), ATT&CK, BlackBerry | Most common public name |
| Rattlesnake, T-APT-04 | Tencent | Listed as aliases in ATT&CK and by Kaspersky |
| Razor Tiger | Listed by BlackBerry | Vendor alias |
Alien Labs noted possible infrastructure overlap with Patchwork (moderate confidence) and the group's use of the Royal Road RTF weaponiser, which is also associated with Chinese groups. Shared tools do not mean shared operators: track the Patchwork Threat Actor Profile Guide group separately.
Targeting and motivation
- Core targets: government, military and diplomatic entities. Alien Labs lists Pakistan, China, Nepal and Afghanistan as recurring, with smaller operations against Myanmar, Qatar, Sri Lanka and Bangladesh.
- Maritime and ports: BlackBerry assessed with medium confidence that June 2024 campaigns targeted ports and maritime facilities in the Mediterranean and Indian Ocean, with lures impersonating the Port of Alexandria and the Red Sea Port Authority. Kaspersky reported a notable rise in maritime and logistics targeting in the second half of 2024.
- Nuclear energy: Kaspersky saw nuclear-themed lures and some targeting of nuclear energy organisations in South Asia. See the Nuclear Facility Cybersecurity Guide.
- Geographic spread: Kaspersky's H2 2024 report lists attacks in Austria, Bangladesh, Cambodia, Djibouti, Egypt, Indonesia, Mozambique, Myanmar, Nepal, Pakistan, the Philippines, Sri Lanka, the UAE and Vietnam, and diplomatic targets in ten more countries including China, India, Saudi Arabia and Turkey.
- Other sectors: telecoms, consulting, IT services, real estate and hotels (Kaspersky); defence technology, research, finance, energy and minerals (Alien Labs, moderate confidence).
- Motivation: espionage and intelligence gathering, as BlackBerry assesses from prior campaigns.
Tactics and techniques (MITRE ATT&CK)
Techniques below are mapped to G0121 in ATT&CK v20 unless marked as from Kaspersky's StealerBot analysis (mapped by NHI Mgmt Group to the closest technique, not by ATT&CK). ATT&CK also maps the open-source Koadic framework (S0250) to the group.
| Tactic | Technique | How it shows up |
|---|---|---|
| Reconnaissance | T1598.002 and T1598.003 Phishing for Information | Attachments and links to credential harvesting pages, including lookalike government webmail |
| Initial access | T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link | DOCX, XLSX, RTF and ZIP archives containing LNK files, tailored per target country |
| Stealth | T1221 Template Injection (Kaspersky, BlackBerry) | DOCX fetching a remote RTF only when opened |
| Execution | T1203 Exploitation for Client Execution | CVE-2017-11882 and CVE-2020-0674 |
| Execution | T1059.007 JavaScript; T1059.005 Visual Basic; T1059.001 PowerShell | Script loaders dropping .NET downloaders |
| Stealth | T1218.005 Mshta | LNK files and shellcode launching mshta.exe to fetch HTA content |
| Stealth, execution | T1574.001 DLL side-loading; T1036.005 Match Legitimate Name | rekeywiz.exe and other signed binaries loading planted DLLs such as propsys.dll |
| Persistence | T1547.001 Registry Run Keys / Startup Folder | Run keys; Kaspersky also saw scheduled tasks |
| Stealth | T1027.013 Encrypted/Encoded File | Base64 and ECDH-P256 encrypted payloads |
| Discovery | T1518.001 Security Software Discovery | WMI SecurityCenter2 queries; a 137-entry process name list (Kaspersky) |
| Credential access | T1056.001 Keylogging; T1056.002 GUI Input Capture; T1539 Steal Web Session Cookie (Kaspersky) | StealerBot keylogger, fake Windows credential prompt, Chrome cookie theft |
| Collection, exfiltration | T1119 Automated Collection; T1074.001 Local Data Staging; T1020 Automated Exfiltration | Files staged in temp folders and sent automatically |
| Command and control | T1071.001 Web Protocols | HTTP C2 |
How they abuse identities and credentials
SideWinder gets in through a document, but the long-term value of each intrusion is identity material. Kaspersky's StealerBot analysis lists more credential modules than any other capability.
| Identity material | How it is taken | Control that limits it |
|---|---|---|
| Government webmail passwords | Phishing pages resembling Nepal army and Pakistan foreign ministry mail (Alien Labs, citing Trend Micro) | Phishing-resistant MFA (FIDO2) on webmail; lookalike domain monitoring |
| Browser passwords, cookies and cloud tokens | StealerBot module for browser passwords, Chrome cookies, Google, Facebook and LinkedIn tokens | Disable browser password storage, short session lifetimes, token binding to device where supported, revoke all sessions after infection |
| RDP credentials | Hooking functions in mstsc.exe | Restricted Admin or Remote Credential Guard for RDP, PAM-brokered admin sessions |
| Windows logon password | Fake credential prompt in explorer.exe that repeats until a valid password is entered | User awareness that Windows never re-prompts at random; Windows Hello for Business to reduce password typing |
| SSH keys | Theft of PuTTY .ppk files | Passphrase-protected keys, short-lived SSH certificates, inventory of keys on endpoints |
| Local privilege | UAC bypass module and Defender exclusions | Remove local admin, tamper protection on, alert on new Defender exclusions |
Stolen tokens and keys are machine credentials in practice: they keep working after the user changes a password. See the Infostealer Logs and Session Token Abuse Guide and the Remote Desktop (RDP) Security Guide.
Notable incidents
| Date | Activity | Source |
|---|---|---|
| 2012 onward | Espionage against South Asian government and military targets | ATT&CK; Kaspersky via Alien Labs |
| April 2018 | First public naming of SideWinder | Kaspersky, via Alien Labs |
| November 2019 | Pakistan NTISB advisory attributes the group to an Indian APT | Alien Labs, January 2021 |
| Late 2019 to 2020 | Credential phishing pages mimicking government mail; Android apps exploiting CVE-2019-2215; COVID-19 lures against Pakistan's military | Alien Labs, citing Trend Micro and Tencent |
| June 2024 | Port authority lures against Mediterranean and Indian Ocean maritime organisations using CVE-2017-0199 and CVE-2017-11882 | BlackBerry |
| 2024 | Expansion to the Middle East and Africa; StealerBot documented | Kaspersky, 15 October 2024 |
| Second half of 2024 | Rise in maritime, logistics and nuclear energy targeting across 14 countries | Kaspersky, 10 March 2025 |
Detection and defence
Detection signals
| Signal | Where to look | Notes |
|---|---|---|
| WINWORD.EXE fetching a .rtf or template from an external URL | EDR network events, proxy logs | Remote template injection |
| EQNEDT32.EXE execution | Process creation (Event ID 4688, Sysmon 1) | Should never run on a patched estate |
| mshta.exe launched by Office, explorer.exe opening an LNK, or with a URL argument | EDR process trees | Core loader stage |
| Signed binaries such as rekeywiz.exe running from user-writable paths and loading local DLLs | Sysmon Event ID 7, EDR | DLL side-loading |
| Changes to Defender exclusions | Microsoft-Windows-Windows Defender/Operational Event ID 5007 | StealerBot adds exclusions |
| Unexpected credential prompts raised by explorer.exe; user reports of repeated prompts | Help desk tickets, EDR UI events | Fake credential phishing module |
| Non-browser processes reading Chrome cookie and Login Data files | EDR file access | Token and password theft |
| Code injected into or hooking mstsc.exe | EDR memory and module events | RDP credential theft |
Hardening plan
- Week 1: confirm every Office build is patched for CVE-2017-11882 and CVE-2017-0199 (both in the CISA KEV catalogue) and that Equation Editor is gone. Load the current Kaspersky and BlackBerry indicators into mail and DNS filters, knowing they will age quickly.
- Weeks 2 to 4: block or restrict outbound template fetches where possible, block LNK and script files in email attachments and ZIPs at the gateway, and enable the attack surface reduction rules for Office child processes and obfuscated scripts in audit mode before enforcing. See the Malicious LNK Files Guide.
- Weeks 4 to 8: restrict mshta.exe for standard users with application control and block execution from user-writable paths. Pilot on one business unit, keep the audit policy as rollback, then widen. See the Living off the Land Guide.
- Quarter 1: enforce phishing-resistant MFA on webmail and VPN, turn on tamper protection, deploy Remote Credential Guard for admin RDP and stop browser password storage on managed devices.
- Response: isolate, capture memory (StealerBot runs in memory), collect Run keys, tasks and side-loading folders, reimage, then revoke all sessions and tokens and rotate RDP, SSH and browser-saved credentials.
Metrics
- Office builds vulnerable to CVE-2017-11882 or CVE-2017-0199: zero.
- mshta.exe executions by standard users per week: trending to zero outside approved use.
- Webmail and VPN accounts on phishing-resistant MFA: 100% for high-risk staff.
- Defender exclusion changes without a change ticket: zero.
- Time from infection confirmation to full token revocation: under two hours.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev. 5 | SI-2 Flaw Remediation, CM-6 Configuration Settings | Office patching, Equation Editor removal |
| NIST SP 800-53 Rev. 5 | SC-18 Mobile Code, SI-4 System Monitoring | Script host control and process monitoring |
| NIST SP 800-53 Rev. 5 | IA-2 Identification and Authentication, AC-6 Least Privilege | Phishing-resistant MFA and removing local admin |
| NIST CSF 2.0 | PR.AT-01, DE.CM-09, DE.AE-02 | Awareness, endpoint monitoring, alert analysis |
| MITRE D3FEND | D3-EAL Executable Allowlisting, D3-DNSDL DNS Denylisting | Blocking side-loaded binaries and known C2 |
Practitioner checklist
- Prove that no Office build in the estate is exploitable through CVE-2017-11882 or CVE-2017-0199.
- Alert on Office fetching remote templates and on any Equation Editor execution.
- Alert on mshta.exe spawned by Office, explorer.exe or with URL arguments.
- Hunt for signed binaries running from user folders and loading local DLLs.
- Monitor Defender exclusion changes (Event ID 5007) and keep tamper protection on.
- Put port, logistics and diplomatic staff on phishing-resistant MFA first.
- After an infection, revoke cloud tokens and rotate RDP and SSH credentials as well as passwords.
- Refresh SideWinder indicators weekly and rely on behaviour rules between updates.
Standards and references
- MITRE ATT&CK: Sidewinder (G0121)
- MITRE ATT&CK: Template Injection
- CISA: Known Exploited Vulnerabilities Catalog
- Kaspersky Securelist: SideWinder APT updates its toolset and targets nuclear sector
- Kaspersky Securelist: SideWinder APT's post-exploitation framework analysis
- BlackBerry: SideWinder targets ports and maritime facilities in the Mediterranean Sea
- AT&T Alien Labs: A global perspective of the SideWinder APT
Related NHI Mgmt Group resources: Threat Actor Groups Guide · Patchwork Threat Actor Profile Guide · Maritime Cybersecurity Guide · Ports and Logistics Cybersecurity Guide · Infostealer Threat Guide