Rattlesnake

The threat actor Rattlesnake, also known as Sidewinder, BabyElephant, APT Q4, APT Q39, Hardcore Nationalist, HN2, RAZOR Tiger, and GroupA21, is a prolific Advanced Persistent Threat (APT) group that has been active since 2012. The group was first publicly identified in 2018 and has launched numerous attacks against high-profile entities across South and Southeast Asia. Rattlesnake's persistent and evolving tactics pose a significant risk to regional cybersecurity, with the group often resorting to spear-phishing attacks using images of official-looking documents. Rattlesnake has been linked to several notable cyberattacks. A report published by Group-IB attributed a malicious document and Nim backdoor payload to Rattlesnake, linking it to a 2020 attack on the Maldivian government and a series of previously unknown phishing operations targeting organizations in Afghanistan, Bhutan, Myanmar, Nepal, and Sri Lanka between June and November 2021. From January to May 2024, the group used Hajj-related emails to target users in Asia and Africa, demonstrating their ability to adapt their tactics to current events and cultural contexts. In recent developments, the Cyble Research Team discovered new malware variants associated with Rattlesnake. Additionally, between late November and March, the group utilized server-based polymorphism to facilitate next-stage backdoor delivery in a cyberattack campaign initially targeting Pakistani government entities before shifting focus to Turkey. This method allows the group to evade detection by creating unique instances of their malicious software for each new victim, further highlighting the sophistication and potential danger posed by Rattlesnake.