Sidewinder

Overview

Sidewinder is a suspected Indian threat actor group that has been active since at least 2012. They have been observed targeting government, military, and business entities throughout Asia, primarily focusing on Pakistan, China, Nepal, and Afghanistan.

Naming & attribution

Sidewinder is tracked under 3 names across the industry. It uses 30 documented ATT&CK techniques — more than 66% of the 174 groups tracked here. Activity attributed since at least 2012.

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• Patchwork — 20 shared techniques (39% overlap)
• Confucius — 13 shared techniques (36% overlap)
• Windshift — 13 shared techniques (36% overlap)
• Tropic Trooper China — 18 shared techniques (35% overlap)
• SideCopy Pakistan — 12 shared techniques (35% overlap)
• Inception Russia — 13 shared techniques (33% overlap)

Targets

Government · Military · Private sector

Regions

Afghanistan · China · Nepal · Pakistan

Capabilities

• Exploitation of public-facing / client applications — ATT&CK T1203

TTPs — 30 techniques across 9 tactics

Tools & malware (1)

Koadic

Reporting (3)

• A Global Perspective of the SideWinder APT — Hegel, T
• SideWinder APT Targets with futuristic Tactics and Techniques — Cyble
• APT Trends report Q1 2018 — Global Research and Analysis Team