Rewterz Threat Alert – APT SideWinder Group – Active IOCs

Severity

High

Analysis Summary

The SideWinder Advanced Persistent Threat (APT) is a state-sponsored hacking group that operates out of China. This group is also known as APT41 and Barium. SideWinder has been active since at least 2012, and it primarily targets organizations in the telecommunications, healthcare, and technology sectors.

The group uses a variety of techniques to gain access to its targets, including spear-phishing, watering hole attacks, and the exploitation of vulnerabilities in software and hardware. Once inside a network, SideWinder uses custom malware and legitimate tools to move laterally, escalate privileges, and exfiltrate data.

SideWinder has been linked to a number of high-profile attacks, including the 2017 Equifax breach and the 2020 attacks on telecommunications companies in Southeast Asia. The group has also been known to engage in financially motivated cybercrime, such as the deployment of cryptominers and ransomware.

Overall, SideWinder is a sophisticated and persistent threat that poses a significant risk to organizations in a range of sectors. Defending against this group requires a multi-layered approach that includes strong security controls, employee training, and ongoing threat intelligence gathering and analysis.

Impact

• Information Theft and Espionage

Indicators of Compromise

Domain Name

• slpa.mod-gov.org

MD5

• 40708e92422f0d1eb05d1e0e1732cd0d
• f6a9ce5cb29328475e2a874cd1b575ff
• 976160013031ba3e0cb8d26d334c8f21
• 3363ed14f070fc651515cd066b2c36aa
• c42dcdb934f3f8d5c242079b5d9f9938

SHA-256

• ddc26a2a607a2cebe94293199035bb72146b4649b7c18b3a7c34868098fbf50a
• c71a77b0d04ce7ca2031e976618e67f72d4fc2c32bc4b4ec0f8ff66b46e57fdf
• e6fbeb46eb4dca4abe9880c67463371bfc83a559187ac9f3a880b237f7547ab1
• 9b51dd4467d17c391ad29d33f8e66fe9b901ba3a1352c8372b715dcfb7eed4d3
• fb195881d2ec8ae160141d4d8df6a7e540736c84c5aa256be686451b5385eb1d

SHA-1

• fb74a91bcd69baaf8898bc163a94ae7ca6fcd559
• 6565664ff63056d38b0e834e0092ce09fc8c43f6
• 0bda06ce3e07a78950417674cceed24ba49683ea
• 47623f397d200023f11b37398b5b6f0fc62479f9
• 227d24a01820d78cc6638e33affcf7d0f9fe99e9

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Emails from unknown senders should always be treated with caution.
• Never trust or open ” links and attachments received from unknown sources/senders.