Rattlesnake

Rattlesnake, also known as Sidewinder, BabyElephant, APT Q4, APT Q39, Hardcore Nationalist, HN2, RAZOR Tiger, and GroupA21, is a threat actor that has been linked to a series of malicious cyber activities. According to a report published by Group-IB, this group was behind the 2020 attack on the Maldivian government and an undisclosed series of phishing operations targeting organizations in Afghanistan, Bhutan, Myanmar, Nepal, and Sri Lanka between June and November 2021. The group's persistent and evolving tactics present a significant risk to regional cybersecurity. In more recent activities, from January to May 2024, the India-linked threat group used Hajj-related emails to target users in Asia and Africa, as reported by Kaspersky. The group frequently employs spear-phishing attacks using images of official-looking documents. Cyble Research Team discovered new malware variants associated with the SideWinder (aka Rattlesnake or T-APT-04) APT threat group, further demonstrating their continuous evolution in cyber offensive capabilities. The suspected state-sponsored group has also been identified as utilizing server-based polymorphism to facilitate next-stage backdoor delivery in a cyberattack campaign. Initially, these attacks targeted Pakistan government entities in late November before shifting focus to Turkey beginning in March, as reported by The Hacker News. This advanced technique allows the group to evade detection and enhance the effectiveness of their attacks, underlining the need for robust vulnerability management and threat intelligence to counter such sophisticated threats.