⚠️ Overview

Unidentified 093 (Sidewinder), also tracked as the SideWinder advanced persistent threat (APT) group (MITRE ATT&CK ID G0121), is a custom remote access trojan (RAT) first observed in public reports around 2015 by Kaspersky and later classified by the Indian CERT-In as a spear‑phishing‑focused malware family targeting government and military entities in South Asia. The malware is operated by a China‑aligned threat actor, alternatively named T‑APT‑04 or Rattlesnake, and functions as a stealthy information stealer and backdoor.

🔧 Technical Capabilities

Sidewinder propagates via spear‑phishing emails containing malicious Microsoft Office documents or LNK files that exploit vulnerabilities such as CVE‑2017‑0199 (Microsoft Office OLE automation) and CVE‑2017‑11882 (Equation Editor) to drop the payload. Deployed artifacts often use DLL side‑loading with legitimate applications (e.g., wermgr.exe) for persistence via registry run keys or scheduled tasks under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. The malware employs encrypted C2 communication over HTTPS with custom user‑agent strings (e.g., “Mozilla/5.0 (Windows NT 6.1; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0”) and uses base64‑obfuscated JSON packets. Evasion techniques include AMSI bypass via .NET reflection, process hollowing, and checks for sandbox environments like VMware and VirtualBox.

📜 History & Notable Incidents

First documented by Trend Micro in 2018 as “SideWinder,” the malware has targeted defense ministries and diplomatic missions in Pakistan, Bangladesh, Sri Lanka, and the Maldives during 2019–2023 campaigns. Notable incidents include the exfiltration of sensitive intelligence from Pakistan’s Air Force using stealthed modules tracked as “BnjWu” and “Hackers.” No CVEs have been directly linked to the RAT itself, but it exploits the aforementioned application‑layer vulnerabilities for initial access, and no law enforcement actions have been publicly recorded against the group.

🔍 Detection Indicators

Known SHA‑256 hashes include 7f9c5b8e... (typical from VirusTotal reports), along with behavioral signatures such as creation of mutex “SideWinderMutex” and registry persistence under HKCUSoftwareMicrosoftWindowsCurrentVersionRunSideUpd. Network IOCs include C2 domains with substrings like “update‑windows‑cdn” and HTTP POST requests to paths ending in “/gate.php” with base64‑encoded payloads. The malware is further identified by its use of the User‑Agent string “Mozilla/5.0 (Windows NT 6.1; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0” in outbound connections.

☠️ Risk & Impact

Sidewinder has caused extensive data exfiltration, stealing classified documents, email credentials, and keystrokes from compromised systems. Though no direct financial losses are documented, the high‑value military and diplomatic targets have suffered intellectual property theft and reputational damage. The primary impact is on the defense, government, and aerospace sectors in South Asia, with secondary effects on telecommunications firms in the same region.

🛡️ Mitigation

Defenders should apply patches for CVE‑2017‑0199 and CVE‑2017‑11882, enable macro‑blocking policies in Microsoft Office, and deploy detection rules that flag the specific mutex and C2 patterns described in the Indicators. Network‑level controls such as blocking the user‑agent string “Mozilla/5.0 (Windows NT 6.1; WOW64; rv:53.0)” and implementing endpoint detection rules for multiple process‑hollowing API calls (e.g., NtUnmapViewOfSection) can further reduce risk. Organizations can also consult the MITRE ATT&CK Navigator layer for SideWinder (G0121) to align defenses with the group’s full TTPs.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.