March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Alert – BumbleBee Malware – Active IOCs
June 24, 2022
Rewterz Threat Alert – AZORult Malware – Active IOCs
June 24, 2022
Rewterz Threat Alert – BumbleBee Malware – Active IOCs
June 24, 2022
Rewterz Threat Alert – AZORult Malware – Active IOCs
June 24, 2022
Severity
High
Analysis Summary
Sidewinder is a suspected Indian threat actor group that has been active since 2012. They have been observed attacking political, military, and corporate organizations throughout Asia, with Pakistan, China, Nepal, and Afghanistan being the most common targets. RAZOR TIGER, Rattlesnake, APT-C-17, and T-APT-04 are the aliases for Sidewinder APT. This APT has been targeting Pakistani government officials with a decoy file related to FOCUSED TALK ON RUSSIAN UKRAINE CONFLICT IMPACT ON PAKISTAN in its most recent effort. They employ custom implementations to attack existing vulnerabilities and then deploy a Powershell payload in the final stages to distribute the malware. Sidewinder was also detected employing credential phishing sites that were copied from their victims’ webmail login pages.
Impact
- Information Theft and Espionage
Indicators of Compromise
MD5
- 964658be544859ddb5d927aeaefe2f86
SHA-256
- 61e18a5c50aeb93c34112e566a2761920b5d3dc9e6090aa5808ee385e8ca3dd7
SHA-1
- 1a87bdd402a58c2130e282213af4eb17f0299d78
Remediation
- Block all threat indicators at your respective controls.
- Search for IOCs in your environment.