SideWinder
Also known asRattlesnake · T-APT-04 · Razor Tiger · Hardcore Nationalist · HN2 · APT-Q-39
Summary
Suspected Indian espionage actor (MITRE G0121) active since at least 2012 with very high-volume spear-phishing against government, military and business targets in Pakistan, China, Nepal, Afghanistan and Sri Lanka. Since 2024 it has widened to maritime, logistics and nuclear organisations and diplomatic missions across the Middle East, Africa and Europe: Kaspersky's H2 2024 victims include Djibouti, Egypt and the United Arab Emirates, with diplomatic targets in Saudi Arabia. 2025: Acronis saw it hit Sri Lanka's central bank and an army battalion plus Bangladeshi and Pakistani government bodies (Jan–May), and Trellix tracked four ClickOnce waves against South Asian diplomats (Mar–Sep). Tradecraft: DOCX remote templates and RTF exploits of CVE-2017-0199 / CVE-2017-11882, DLL side-loading, ModuleInstaller and the StealerBot .NET stealer.
Attribution
No service publicly attributed
Hedged, circumstantial or press-only reporting; not established.
- MITRE ATT&CK (MITRE ATT&CK, 2026-10)
Suspected Indian
Campaigns 3
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| ClickOnce South Asia diplomatic waves | 2025-03 – 2025-09 | Bangladesh, Pakistan, Sri Lanka, Foreign embassies in India | Government, Diplomatic | Trellix (2025-10-22) — PDF lure → fake Adobe Reader update ClickOnce app → MagTek DLL side-load → ModuleInstaller/StealerBot; four waves Mar–Sep 2025 |
| South Asian public sector — Central Bank of Sri Lanka, Sri Lanka Army, Bangladesh and Pakistan (StealerBot) | 2025-01 – 2025-05 | Sri Lanka, Bangladesh, Pakistan | Government, Military, Financial | Acronis TRU (2025-05-20) |
| Maritime, logistics & nuclear expansion (StealerBot) | 2024 | Djibouti, Egypt, UAE, Saudi Arabia, Bangladesh, Sri Lanka, Austria, Cambodia, Indonesia, Mozambique, Vietnam | Maritime, Logistics, Nuclear, Government, Diplomatic | Kaspersky GReAT (2025-03-10) — DOCX remote template → RTF CVE-2017-11882 → Backdoor Loader → StealerBot; H2 2024 activity |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 7
| Initial Access1 | T1566.001Spearphishing Attachment |
|---|---|
| Execution3 | T1059.001PowerShellT1059.005Visual BasicT1203Exploitation for Client Execution |
| Stealth3 | T1036MasqueradingT1574.001DLLT1221Template Injection |
Malware and tools 5
| Name | Description | Platform |
|---|---|---|
| ModuleInstaller | Loader | Windows |
| WarHawk | Backdoor | Windows |
| SFX RAT | Self-extracting Backdoor | Windows |
| StealerBot | Post-exploitation Toolkit | Windows |
| Backdoor Loader | Loader (side-loaded DLL) | Windows |
Exploited vulnerabilities 3
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2017-0199 | 7.8 | Microsoft Office/WordPad — OLE/RTF remote code execution (KEV 2021-11-03) |
| CVE-2017-11882 | 7.8 | Microsoft Office — Equation Editor memory corruption (KEV 2021-11-03) |
| CVE-2020-0674 | 7.5 | Internet Explorer scripting engine — memory corruption RCE (KEV 2021-11-03) |
Highest CVSS first.
Infrastructure patterns
- Steady C2 domain churn, peaking at 34 new or repointed domains in January 2025 (Acronis, 2025)