Sidewinder (Rattlesnake)
Suspected India-linked espionage group active since 2012, phishing South Asian governments, militaries, diplomats and, lately, maritime and nuclear targets with StealerBot.
- Active
- 2012 to March 2026
- Origin
- India (suspected; vendor assessment, no government attribution)
- Type
- State-sponsored
- Affiliates
- Patchwork (tool and document sharing reported by Group-IB), DoNot Team, Baby Elephant (Group-IB: likely same or closely related), SideCopy (imitator per Kaspersky)
- Regions targeted
- Pakistan, Sri Lanka, Nepal, Bangladesh, Afghanistan, Myanmar, Bhutan, China, Maldives, Turkey, Egypt, Djibouti, Saudi Arabia, UAE, Jordan, Indonesia, Thailand, Cambodia, Vietnam, Mozambique, Middle East, Africa
- MITRE ATT&CK
- G0121
What each vendor calls it
- CrowdStrike
- RAZOR TIGER
Also known as APT-C-17 Qihoo 360RattlesnakeT-APT-04
Profile
SideWinder is a South Asia-focused espionage group that has been running phishing campaigns since at least 2012. Kaspersky first wrote about it publicly in its Q1 2018 APT trends report, describing a group that went mainly after Pakistani military targets. MITRE ATT&CK calls it a suspected Indian threat actor, and most vendors say much the same: the group is “believed to” originate from India, usually citing MITRE. No government has formally attributed it. Kaspersky’s own position has moved around: in 2018 it had low confidence that the malware may have been written by an Indian company, and in 2022 its researcher told The Register that the indicators behind the India link had disappeared and she would not tie the group to any nation. Treat the India attribution as a widely shared vendor assessment, not a settled fact.
The target list reads like a map of the neighborhood. Pakistan has always been the main focus, especially its military, navy and government ministries, followed by Sri Lanka, Nepal, Bangladesh, Afghanistan, Myanmar, Bhutan and China. Trend Micro documented a year of credential phishing against Nepal’s government, army and central bank and Afghanistan’s presidential offices, with lures built around the Nepal-India border map dispute. Central banks show up again and again: Group-IB found fake sites imitating the Central Bank of Myanmar, Acronis saw a lure sent to the IT director of the Central Bank of Sri Lanka, and Hunt.io found phishing pages copying Nepal’s finance ministry and Myanmar’s central bank.
The delivery chain has barely changed in years, and it still works. A spearphishing email carries a Word document that pulls a remote template (T1221 (Template Injection)) using CVE-2017-0199, which fetches an RTF exploiting the 2017 Equation Editor flaw CVE-2017-11882 (T1203 (Exploitation for Client Execution)). From there, JavaScript and mshta.exe (T1218.005 (System Binary Proxy Execution: Mshta)) drop a .NET loader, and a signed legitimate program side-loads a malicious DLL (T1574.001 (Hijack Execution Flow: DLL)). Older campaigns used the Windows rekeywiz.exe and credwiz.exe utilities for side-loading; recent ones use whatever signed binary fits, including a MagTek executable dressed up as Adobe Reader. Kaspersky’s March 2025 report still shows CVE-2017-11882, patched in 2017, as the entry point.
What the group lacks in new exploits it makes up for in gatekeeping. Group-IB described SideWinder.AntiBot.Script, a script on phishing pages that profiles each visitor’s browser and sends anyone outside Pakistan, or anything that looks like an analysis sandbox, to a real government site. BlackBerry (now part of Arctic Wolf) found server-side polymorphism: the server returns a different payload on every request, and only to Pakistani IP addresses, while everyone else gets an 8-byte dummy file. Shellcode checks RAM size and processor type before continuing (T1497.001 (Virtualization/Sandbox Evasion: System Checks)). Kaspersky says the group watches for detections of its tools and ships modified versions, sometimes within five hours.
The main implant today is StealerBot, a modular .NET toolkit that Kaspersky documented in October 2024 and describes as private to SideWinder. It loads in memory and carries plugins for keylogging (T1056.001 (Input Capture: Keylogging)), screenshots, file theft, RDP credential theft, token grabbing, credential phishing and UAC bypass. It is installed by a .NET downloader called ModuleInstaller and a side-loaded backdoor loader that Kaspersky says has been in use since 2020. The group also runs a mobile track: Trend Micro tied three Google Play apps to its infrastructure in 2020, one of which exploited the Android Binder flaw CVE-2019-2215 for root, the first known in-the-wild use of that bug.
The biggest shift in the last two years is geographic. Kaspersky reported in 2024 that SideWinder had moved into the Middle East and Africa, hitting government, logistics and telecom targets in places such as Djibouti, Jordan, Saudi Arabia, the UAE and Turkey, and in March 2025 it added maritime and nuclear energy organizations to the list, with lures posing as port authorities and nuclear agencies. BlackBerry saw the same maritime turn in July 2024 with lures impersonating the Port of Alexandria and the Red Sea port authority. In 2025 Trellix reported a new PDF and ClickOnce chain aimed at diplomats, including a European embassy in New Delhi, and in March 2026 Dark Reading reported expansion into Indonesia and Thailand.
SideWinder sits in a crowded South Asian field, and the lines between groups are blurry. Group-IB says SideWinder, DoNot and Patchwork (also called Hangover) sometimes borrow tools and malicious documents from each other, and that SideWinder and Baby Elephant are most likely the same or closely related. ThreatRoundup profiles Patchwork separately on its Patchwork page. Seqrite, which named it, and MITRE describe an imitator, SideCopy, that copies SideWinder’s infection chain to muddy attribution. Names vary by vendor: CrowdStrike tracks it as RAZOR TIGER, Qihoo 360 as APT-C-17, and others use Rattlesnake and T-APT-04 (full list above).
Events
| Date | Target | Narrative | Source | Our coverage |
|---|---|---|---|---|
| 2026-03 | Government, telecom and critical infrastructure organizations in Indonesia and Thailand | Dark Reading reports the group expanding into Southeast Asia with its usual chain: spearphishing, long-patched Office flaws, DLL hijacking and staged payloads, with command-and-control addresses worked out at runtime so operators can rotate servers without rebuilding malware. | Dark Reading (citing ITSEC Group) | |
| 2025-03 to 2025-09 | European embassy in New Delhi; government organizations in Sri Lanka, Pakistan and Bangladesh | Four spearphishing waves. A PDF urges the victim to install the “latest” Adobe Reader, which downloads a ClickOnce application; a signed MagTek executable side-loads a malicious DLL that launches ModuleInstaller and then StealerBot. Lures impersonated Pakistan’s Ministry of Defence and downloads were geofenced to South Asia. Reported by Trellix. | The Hacker News (on Trellix) | |
| 2025-05 to 2025-09 | Government, military, maritime and banking organizations in Pakistan, Sri Lanka, Nepal, Bangladesh and Myanmar | Operation SouthNet: fake Outlook and Zimbra login pages hosted on Netlify, Cloudflare Pages and Workers and other free platforms (T1583.006 (Acquire Infrastructure: Web Services)), imitating ministries, navies, a central bank and Pakistan’s space agency, plus open directories serving weaponized documents. Pakistan accounted for about 40% of the domains. | Hunt.io | |
| 2025-01 to 2025-05 | Central Bank of Sri Lanka, Sri Lanka Army 55th Division, government bodies in Bangladesh and Pakistan | Word documents exploit CVE-2017-0199 and CVE-2017-11882; the server checks the victim’s IP and browser before serving a payload. Shellcode loaders inject into explorer.exe, and TapiUnattend.exe side-loads a DLL that runs StealerBot in memory. Persistence via a Startup folder shortcut (T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)). | Acronis | |
| 2024 | Maritime, logistics and nuclear energy organizations and diplomatic entities across South and Southeast Asia, the Middle East and Africa | Lures posing as port authorities and nuclear agencies deliver the Backdoor Loader and StealerBot via CVE-2017-11882. Victims in countries including Egypt, Djibouti, the UAE, Bangladesh, Cambodia, Vietnam, Mozambique and Austria. The group regenerated malware quickly after detections. | Kaspersky | |
| 2024-10 | Government, military, logistics, telecom, financial and university targets in South Asia, the Middle East and Africa | Kaspersky documents StealerBot, a private modular .NET implant with keylogging, screenshot, file-stealing, RDP credential and token-grabbing plugins, and reports expansion to Djibouti, Jordan, Saudi Arabia, Turkey, the UAE and others. | Kaspersky | |
| 2024-01 to 2024-07 | Ports and maritime facilities in the Indian Ocean and Mediterranean (Pakistan, Egypt, Sri Lanka, with signs of Bangladesh, Myanmar, Nepal and the Maldives) | Lures impersonating the Port of Alexandria and the Red Sea port authority, with alarming titles about salary cuts and harassment investigations. CVE-2017-0199 and CVE-2017-11882 chain; second stage served from an old Tor node. Medium-confidence attribution by BlackBerry. | Arctic Wolf (BlackBerry) | |
| 2023-03 | Pakistani government officials; a victim in Turkey | Lures posing as Pakistan Navy War College journal guidelines use remote template injection. The server returns a unique payload on each request and only to Pakistani IP addresses. A server configured for a victim in Turkey marked a new target, which BlackBerry linked to Turkey’s support for Pakistan. | Arctic Wolf (BlackBerry) | |
| 2023-05 | Pakistani and Chinese organizations | Group-IB and Bridewell identify 55 previously unknown SideWinder servers, with domains impersonating the State Bank of Pakistan, Pakistani police forces, the Ministry of Foreign Affairs and the armed forces, plus an Android app posing as a Ludo game. Group-IB notified affected organizations. | Group-IB / Bridewell | |
| 2021-06 to 2021-11 | 61 government, military, law enforcement, financial, telecom and media organizations in Afghanistan, Bhutan, Myanmar, Nepal and Sri Lanka | Phishing campaign uncovered from a backup archive; fake sites imitated the Central Bank of Myanmar and two cryptocurrency firms. New tools SideWinder.RAT.b and SideWinder.StealerPy sent stolen data through Telegram. Group-IB could not say whether any attempt succeeded. | Group-IB | |
| 2021-05 to 2022-05 | Pakistani government and military personnel | Phishing links on email and Facebook impersonating the Ministry of Finance, NADRA, COVID-19 booster guidance and Hajj travel. A filtering script redirects non-Pakistani visitors to finance.gov.pk; others get a ZIP with an LNK that runs mshta and side-loads a backdoor through credwiz.exe. | Group-IB | |
| 2020-04 to 2022-05 | Military and law enforcement agencies in Pakistan, Bangladesh and other South Asian countries | Kaspersky counts almost 1,000 attacks in two years, over 1,000 malware samples with unique encryption keys and more than 400 domains. Presented at Black Hat Asia 2022. | The Register (on Kaspersky) | |
| 2019-11 to 2020-11 | Nepal’s government, army, police and central bank; Afghanistan’s presidential offices; Sri Lanka’s defence ministry; China’s foreign ministry | Credential phishing on look-alike webmail and Outlook Web Access pages (T1598.003 (Phishing for Information: Spearphishing Link)), lures on COVID-19 and the Nepal-India-China border disputes, plus CVE-2017-11882 documents and early-stage Android apps. | Trend Micro | |
| 2020-06 | Air University, Pakistan | A decoy PDF about online classes during COVID-19 fetches an HTA dropper that uses mshta.exe and plants a fake rekeywiz.exe in ProgramData. | Rewterz | |
| 2020-01 | Android users (about 10 downloads) | Three Google Play apps (Camero, FileCrypt Manager, callCam) work together; Camero exploits the Android Binder flaw CVE-2019-2215 for root, and callCam steals location, files, screenshots and data from messaging and email apps. Linked to SideWinder via shared C2 servers. | Trend Micro | |
| 2018-04 | Pakistani military targets | Kaspersky’s first public mention: a group active since at least 2012, exploiting CVE-2017-11882 and dropping a PowerShell payload. | Kaspersky | |
| 2012 | Not disclosed | Earliest activity Kaspersky and MITRE ATT&CK attribute to the group. | MITRE ATT&CK |
Target vectors risk profile
| Government | Defense | Diplomatic | Transportation/logistics | Espionage | Finance | Energy | Telecom | Cloud/identity | Mobile devices | Education/research | Crypto/DeFi | Edge devices/VPNs | Ransomware/extortion |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| High | High | High | High | High | Medium | Medium | Medium | Medium | Medium | Low | Low | N/A | N/A |
Malware and tools
| Name | What it does | Public detection | Hunt Leads | Reports |
|---|---|---|---|---|
| StealerBot | Private modular .NET implant loaded in memory, with plugins for keylogging, screenshots, file theft, RDP credentials, tokens, credential phishing and UAC bypass | Indicators in Kaspersky’s and Acronis’s reports | Kaspersky, Acronis | |
| ModuleInstaller | .NET downloader that fingerprints security products, drops files, sets persistence and installs the backdoor loader | Indicators in Kaspersky’s report | Kaspersky | |
| Backdoor Loader | DLL side-loaded by a signed legitimate program; patches AMSI, decrypts and runs StealerBot. .NET and C++ variants under many file names | Indicators in Kaspersky’s report | Kaspersky | |
| App.dll (Downloader Module) | .NET downloader decoded by the JavaScript loader; checks installed antivirus before fetching the next stage | Indicators in the vendor reports | Arctic Wolf (BlackBerry), Kaspersky | |
| SideWinder.RAT.b, SideWinder.StealerPy | Remote access trojan and Python infostealer (browser history, saved credentials, files) that exfiltrate through Telegram | Indicators in Group-IB’s report | Group-IB | |
| SideWinder.AntiBot.Script | Phishing-page filter that profiles visitors and redirects non-targets and sandboxes to legitimate sites | Indicators in Group-IB’s report | Group-IB | |
| callCam (with Camero and FileCrypt Manager droppers) | Android spyware collecting location, files, screenshots, accounts and app data; Camero roots devices with CVE-2019-2215 | Indicators in Trend Micro’s report | Trend Micro | |
| Koadic | Open-source post-exploitation framework MITRE links to the group | Published Sigma rules (SigmaHQ) | MITRE ATT&CK |
Reports
Vulnerabilities exploited
| Vulnerability | CVSS | Severity | Publisher | Platform | CISA KEV |
|---|---|---|---|---|---|
| CVE-2017-11882 | 7.8 | High | Microsoft | Microsoft Office (Equation Editor) | Yes |
| CVE-2017-0199 | 7.8 | High | Microsoft | Microsoft Office and Windows (OLE/RTF handling) | Yes |
| CVE-2020-0674 | 7.5 | High | Microsoft | Internet Explorer scripting engine | Yes |
| CVE-2019-2215 | 7.8 | High | Android kernel (Binder) | Yes |
If you’re in their sights
Do this now
- Patch Office, and remove the old Equation Editor component if anything still has it. This group’s main exploits, CVE-2017-0199 and CVE-2017-11882, were fixed in 2017 and still land years later on unpatched machines.
- Block or alert on Office documents fetching remote templates, and on Office or PDF readers spawning mshta.exe, wscript or PowerShell. Block ClickOnce installs from the internet unless you need them.
- Hunt for signed programs running from user-writable folders such as %AppData% and ProgramData next to unexpected DLLs (rekeywiz.exe, credwiz.exe, TapiUnattend.exe and look-alikes), and for new Startup folder shortcuts or Run keys pointing there.
- Protect webmail with phishing-resistant MFA (security keys or passkeys) and train staff that a ministry, navy or central bank login page reached from an email link is suspect, especially one on a free hosting domain.
- Don’t rely on hash-based indicators alone: the group serves a different payload on every request and rebuilds malware within hours. Detect on behavior instead.
Compiled from Kaspersky, Group-IB, Bridewell, BlackBerry and Arctic Wolf, Trend Micro, Acronis, Trellix, Hunt.io, Rewterz, The Register, The Hacker News, Dark Reading and MITRE ATT&CK, plus ThreatRoundup reporting. Last reviewed November 1, 2026.
ATT&CK techniques (30)
Techniques MITRE ATT&CK links to this group from public reporting, grouped by tactic. A technique can sit under more than one tactic.
Reconnaissance 2
Initial Access 2
Execution 8
- T1059.001 (Command and Scripting Interpreter: PowerShell)
- T1059.005 (Command and Scripting Interpreter: Visual Basic)
- T1059.007 (Command and Scripting Interpreter: JavaScript)
- T1203 (Exploitation for Client Execution)
- T1204.001 (User Execution: Malicious Link)
- T1204.002 (User Execution: Malicious File)
- T1559.002 (Inter-Process Communication: Dynamic Data Exchange)
- T1574.001 (Hijack Execution Flow: DLL)