• Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Press Release
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – Agent Tesla Malware – Active IOCs
March 10, 2022
Rewterz Threat Advisory – Multiple Mozilla Firefox Vulnerabilities
March 10, 2022

Rewterz Threat Alert – APT SideWinder Group – Active IOCs

March 10, 2022

Severity

High

Analysis Summary

Sidewinder is a suspected Indian threat actor group that has been active since 2012. They have observed attacking political, military, and corporate organizations throughout Asia, with Pakistan, China, Nepal, and Afghanistan being the most common targets. RAZOR TIGER, Rattlesnake, APT-C-17, and T-APT-04 are some of the other names for Sidewinder APT. It has been detected targeting Pakistani government officials with a decoy file related to COVID-19 in its most recent effort. They employ custom implementations to attack existing vulnerabilities and then deploy a Powershell payload in the final stages to distribute the malware. Sidewinder was also detected employing credential phishing sites that were copied from their victims’ webmail login pages.

Staying attentive while receiving an email from an unknown sender, utilizing a reputable anti-malware solution, and avoiding clicking on suspicious links or files are some of the remediations for this APT.

Impact

  • Information Theft and Espionage

Indicators of Compromise

MD5

  • c8e1010b7ee1647b582048bfd67a9e0e
  • 04effbbd901879abcd2834e530d5e9ad
  • 7bcdef8e11c27e65e7016d145a24d195
  • 6162005b9ae5d4a8070bfe5f560b0912
  • c19201cbd7ad2221844268c0ba694a3a
  • 277955afbf4ca44a018961f66a603f82

SHA-256

  • 1a9d8b16ef6132884161bd820fe24cbfc8dc9514c3b31d7eacf4de707899dd6a
  • f7eb8fdb6eabb2fb64314c898c621c4aedb8c167c50bd62ad799fa2c0bc306b6
  • 5e1ac5f28b37afc3b2a1902ee7c68485b3fcc55d648ff9e5309646a77ff53882
  • d8aa512b03a5fc451f9b7bc181d842936798d5facf1b20a2d91d8fdd82aa28b7
  • f44fd723398e148f7d437d22a417fd5b4c4f835a7b5a7c1624706e942320afa4
  • 319bd26ad751a79b1b1c474749d3d856277b712f1eca3b1a88a8605a8f2facaf

SHA-1

  • 2a71114f70b711da6b46e2e35562e4326e09d8bc
  • a683f08912a3c845f0360f52a399f1774f9158c2
  • c15a35dfbae4789b62b88ab268c5849255837edd
  • b4928e4c3a8787e0461e2e78138091134c7f719a
  • 3669f18e92eed9f4a0a8ee3df284798ff7a7a232
  • d3862d50c36d03bab2d6b3f78c17f2fdd0704451

Remediation

  • Block all threat indicators at your respective controls.
  • Search for IOCs in your environment.
  • Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.