Rewterz Threat Alert – SideWinder APT Group aka Rattlesnake – Active IOCs

Severity

High

Analysis Summary

The SideWinder APT (Advanced Persistent Threat) Group is a sophisticated cyber espionage group active since at least 2012. The group is believed to be based in India and has targeted government agencies, military organizations, and financial institutions in South Asia and the Middle East.

The SideWinder APT group is known for using a range of sophisticated tactics and techniques to carry out its attacks. These include social engineering, spear-phishing, and zero-day exploits to infiltrate target networks. Once inside a target network, the group uses custom malware and backdoors to gain persistent access and steal sensitive data. SideWinder is known for its advanced tactics, techniques, and procedures (TTPs), which enable it to conduct long-term, stealthy operations to infiltrate and exfiltrate sensitive information. Their primary objectives are espionage, data theft, and information gathering for intelligence purposes. SideWinder has been associated with politically motivated attacks and has targeted diplomatic and military entities to gain geopolitical intelligence.

Some of the most notable attacks attributed to the SideWinder APT group include the compromise of the Indian embassy in Kabul in 2013, the targeting of the Pakistani Air Force in 2015, and the compromise of a Ukrainian military website in 2018.

Given the group’s long history of successful attacks and the sophistication of its tactics, organizations need to remain vigilant and take proactive measures to protect their networks against SideWinder APT group attacks. This includes implementing robust cybersecurity measures, conducting regular security assessments, and providing ongoing employee training to help them identify and prevent social engineering and phishing attacks.

Impact

• Information Theft
• Cyber Espionage

Indicators of Compromise

Domain Name

• cloud-ntdc.servehttp.com
• e-supportntc.servehttp.com
• financeptcl-govpk.servehttp.com
• flysmart-piac.servehttp.com
• services-ptclnetpk.servehttp.com
• wetransfer.servehttp.com
• sarabanmithnavy.tni-mil.com

MD5

• 5cc784afb69c153ab325266e8a7afaf4
• 9431c1d0ba55e6a84dbb81c7d03f1fc7
• 5cca7559186d25707d70e91da6865fcb
• 1bb1b755cfe729eaf4a2a61f9174767c
• a37f50220dce5edd6c3a36835127abba

SHA-256

• c1c2e76202aad8f4a0274daf8d5b2f747dee516623ab53b9ef7f929cc4091c36
• 170ccf1225154fa0cd92a14219f0b912479cc4095203646c38a31bb78baafe9f
• 921496822997485059ad137e7cd25060cbe6abc9466f2e33c1d7df01630737f4
• f92a77fb2004594061e20ae10a1754d90a9e0fe32ec3110408daf340544f97a5
• 35ca581690ffd3e95b33f4f765f8c3209bfa3340f03dbc1643371f19c3cbd98a

SHA-1

• 85500978ed7a617eb1eaae873498523bb9cb0b28
• efd8724613b2a882661fe339e70ebe69ba2b741c
• cedfa7843dd0d312f1d0a0dabf699de5273e7f58
• cfdd21ab4254b98a009d89073abd497f789c64d4
• 758c618585a537fee592ea4d15b24b833188e335

URL

• https://services-ptclnetpk.servehttp.com/2023/Unlimitted-Internet-Netflix-Subscription
• https://services-ptclnetpk.servehttp.com/2023/Unlimitted-Internet-Netflix.html

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Emails from unknown senders should always be treated with caution.
• Never trust or open links and attachments received from unknown sources/senders.
• Maintain cyber hygiene by updating your antivirus software and implementing a patch management lifecycle.
• Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zerodays.
• Enable antivirus and antimalware software and update signature definitions in a timely manner. Using multilayered protection is necessary to secure vulnerable assets
• Enforce strong password policies across the organization. Encourage the use of complex passwords and enable multifactor authentication (MFA) wherever possible to add an extra layer of security.
• Deploy reliable endpoint protection solutions that include antivirus, antimalware, and hostbased intrusion prevention systems (HIPS) to detect and block malicious activities.
• Utilize web filtering and content inspection tools to block access to malicious websites and prevent users from downloading malicious files.
• Deploy IDPS solutions to detect and block suspicious network traffic and intrusions. 
• Conduct regular vulnerability assessments and penetration testing to identify weaknesses in the network infrastructure and address them before they are exploited by attackers.
• Continuously monitor network traffic and security logs for any signs of suspicious activities. Stay updated on the latest threat intelligence to understand the tactics, techniques, and procedures (TTPs) employed by the Sidewinder APT group and other threat actors.