Rewterz Threat Alert – SideWinder APT Group – Active IOCs

Severity

High

Analysis Summary

The SideWinder APT (Advanced Persistent Threat) Group is a sophisticated cyber espionage group that has been active since at least 2012. The group is believed to be based in India and has targeted government agencies, military organizations, and financial institutions in South Asia and the Middle East.

The SideWinder APT group is known for using a range of sophisticated tactics and techniques to carry out its attacks. These include social engineering, spear-phishing, and the use of zero-day exploits to infiltrate target networks. Once inside a target network, the group uses custom malware and backdoors to gain persistent access and steal sensitive data.

Some of the most notable attacks attributed to the SideWinder APT group include the compromise of the Indian embassy in Kabul in 2013, the targeting of the Pakistani Air Force in 2015, and the compromise of a Ukrainian military website in 2018.

Given the group’s long history of successful attacks and the sophistication of its tactics, it is essential for organizations to remain vigilant and take proactive measures to protect their networks against SideWinder APT group attacks. This includes implementing robust cybersecurity measures, conducting regular security assessments, and providing ongoing training to employees to help them identify and prevent social engineering and phishing attacks.

Impact

• Information Theft and Espionage

Indicators of Compromise

MD5

• 8a6392fc9a9c2ec505c4176e3ed0c40b
• 577419f202182f6e933c1cf83ef922ea
• 00f6982debf7fc28b7e70b041bc22cf7
• 01feae91b15c37d5d58618451c7fcf57
• 19cea8c2a22bf7d5a786983b324fc937

SHA-256

• b1e994c7441fd984efdc37980b83e7fe8947e3e8670fc4e3d87545cda557efd2
• ba06e43aeaad50e7196a44d8422eee85deba75754f891102bcd9bd6255b1e6ca
• f4ab529f16fd2e88c1e552fdaacacf59c40cf863dfa6356beadaf310d5ae6544
• 2e844ab5eca01c6949c7d041cae3ff55331e06bdbb7427f4954088d1457d5032
• 54d1983d95fccb38c12add3ad83509b1917a73593f8a819c4d89292874d59c35

SHA-1

• b248dc0cce1076019ff16ecc4d630eea6e713d70
• e291fd593e7c51cc0c214caacc72f5f44bd7d565
• 0ea8bb9950585da9969e4da760837fa88505542a
• 9f94ab3f1f1fffe7548ada786c2bd37aabacd38e
• 5235c7b045da2573b52307afba5bce958ad56549

URL

• https://mtss.bol-south.org/5974/1/8682/2/0/0/0/m/files-b2dff0ca/file.rtf
• http://webmail-org.servehttp.com/@/@/h31l0/d.txt
• http://webmail-org.servehttp.com/@/@/h31l0/
• http://microsoft-winupdate.servehttp.com/@/MOWA/
• http://microsoft-patches.servehttp.com/@/@/h31l0/t.txt

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Emails from unknown senders should always be treated with caution.
• Never trust or open links and attachments received from unknown sources/senders.