Sidewinder

Sidewinder is a threat actor group that has been active since at least 2012, with possible origins in South Asia. The group has a history of malicious activities and has been linked to a variety of cyber threats, including the use of the Nim backdoor payload. Sidewinder has targeted entities in multiple countries, notably regional rivals such as Pakistan, but also Turkey, China, and maritime facilities across various countries. The group is known for its sophisticated attacks, often involving phishing campaigns and the use of malware families previously associated with other known threat actors. In recent campaigns, Sidewinder has focused on ports and maritime facilities, particularly in the Mediterranean Sea. The group has used falsified documents from specific ports, such as the Port of Alexandria in Egypt, to lure victims into their phishing traps. High-interest topics like job termination and salary reductions have been used as bait. These campaigns underscore the evolving nature of Sidewinder's threats, demonstrating their ability to adapt and exploit new infrastructure for their operations. The discovery of a malicious Word document equipped with an embedded macro in 2023 led to further unravelling of Sidewinder's tactics. This document was possibly intended to target Nepalese government officials, showing the group's wide range of targets. Additionally, Sidewinder has been linked to the Mysterious Elephant malware discovered during the same year. Despite the age of some exploits, Sidewinder continues to utilize them effectively, showcasing the persistent and evolving threat posed by this group.