Sidewinder

Sidewinder, a threat actor with a history of malicious activities dating back to 2012, has been linked to a series of sophisticated cyber threats targeting maritime facilities in multiple countries and government officials in Nepal. The group, believed to have South Asian origins, is known for its use of public exploits, remote access Trojans (RATs), malicious .lnk files, and scripts as infection vectors. Despite being perceived as a low-skilled threat group, the detailed analysis of their recent activities underscores the evolving nature of cyber threats they pose. The Sidewinder group has broadened its geographical reach, launching attacks against high-profile entities and strategic infrastructure targets across Asia, the Middle East, Africa, Europe, and specifically in countries such as Bangladesh, Djibouti, Jordan, Malaysia, Maldives, Myanmar, Nepal, Pakistan, Saudi Arabia, Sri Lanka, Turkey, and the United Arab Emirates. The group utilizes an advanced modular implant called StealerBot for espionage activities. Their typical attack chain involves loading malware components into the memory of the infected machine through a backdoor loader dubbed "ModuleInstaller", which deploys a Trojan used by Sidewinder to maintain a foothold on compromised machines. Kaspersky's research into Sidewinder's recent activities revealed new targets and post-exploitation tools and techniques. The researchers provided a comprehensive list of indicators of compromise (IoCs) for various stages of the attack to aid defenders in recognizing the presence of Sidewinder and its tool, StealerBot, on their networks. The latest attacks also unveiled some of Sidewinder's post-compromise activities, which had remained largely unknown despite years of study by researchers. This indicates a significant evolution in Sidewinder's operations, signaling a potential increase in the sophistication and scope of future threats.