Sidewinder
Also known as:T-APT-04 · Rattlesnake
Overview
Sidewinder is a suspected Indian threat actor group that has been active since at least 2012. They have been observed targeting government, military, and business entities throughout Asia, primarily focusing on Pakistan, China, Nepal, and Afghanistan.
Naming & attribution
Sidewinder is tracked under 3 names across the industry. It uses 30 documented ATT&CK techniques — more than 66% of the 174 groups tracked here. Activity attributed since at least 2012.
| Name | First reported by |
|---|---|
| T-APT-04 | Cyble |
| Rattlesnake | Cyble |
Closest groups by technique overlap
Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.
- Patchwork — 20 shared techniques (39% overlap)
- Confucius — 13 shared techniques (36% overlap)
- Windshift — 13 shared techniques (36% overlap)
- Tropic Trooper China — 18 shared techniques (35% overlap)
- SideCopy Pakistan — 12 shared techniques (35% overlap)
- Inception Russia — 13 shared techniques (33% overlap)
Malware families with tracked indicators
One family attributed to Sidewinder, with 66 deduplicated indicators observed across abuse.ch ThreatFox, MalwareBazaar, URLhaus and SSLBL over the corpus's window (up to three years, as of 2026-10-30). MITRE documents what a group does; these are the indicators its malware families have surfaced in that window.
- Koadic66 indicators
Browse or copy the indicators by hash, domain, IP or URL, filtered by age from 1 day to 3 years.
Targets
Government · Military · Private sector
Regions
Afghanistan · China · Nepal · Pakistan
Capabilities
- Exploitation of public-facing / client applications — ATT&CK T1203
TTPs — 30 techniques across 9 tactics
Reconnaissance
T1598.002Spearphishing AttachmentT1598.003Spearphishing Link
Initial Access
T1566.001Spearphishing AttachmentT1566.002Spearphishing Link
Execution
T1059.001PowerShellT1059.005Visual BasicT1059.007JavaScriptT1203Exploitation for Client ExecutionT1204.001Malicious LinkT1204.002Malicious FileT1559.002Dynamic Data Exchange
Persistence
T1547.001Registry Run Keys / Startup Folder
Stealth
T1027.010Command ObfuscationT1027.013Encrypted/Encoded FileT1036.005Match Legitimate Resource Name or LocationT1218.005MshtaT1574.001DLL
Discovery
Collection
T1074.001Local Data StagingT1119Automated Collection
Command and Control
T1071.001Web ProtocolsT1105Ingress Tool Transfer
Exfiltration
Tools & malware (1)
Koadic
Reporting (3)
- A Global Perspective of the SideWinder APT — Hegel, T
- SideWinder APT Targets with futuristic Tactics and Techniques — Cyble
- APT Trends report Q1 2018 — Global Research and Analysis Team