Log in Request a demo

Threat group profile

SideWinder

Also known as T-APT-04, Rattlesnake, Razor Tiger

Attributed by MITRE ATT&CK as a suspected Indian threat actor group active since at least 2012, SideWinder is reported by the national CERTs of Pakistan and Bangladesh, CERT-EU and ENISA to send spearphishing emails to government, military and diplomatic bodies, mainly in South Asia.

In short

Attributed by MITRE ATT&CK as a suspected Indian threat actor group active since at least 2012, SideWinder is reported by the national CERTs of Pakistan and Bangladesh, CERT-EU and ENISA to send spearphishing emails to government, military and diplomatic bodies, mainly in South Asia. Sources differ on how sure they are about the India link, and none names a sponsor.

Last updated 9 October 2026

Profile MapThreat Group
  1. Attributed OriginIndia
  2. Names6names in public reportsSidewinder · T-APT-04 · Rattlesnake
  3. Sectors10named as targetsHighest executive offices · Mediterranean and Indian Ocean · EU embassies
  4. Techniques12in the attack chainReconnaissance · Initial Access · Execution
  5. Tools10tools and malware listedKoadic · WarHaw · Script loaders

In one minute

Who they are
MITRE ATT&CK describes SideWinder as a suspected Indian threat actor group, active since at least 2012. Where sources hedge (MITRE, the Bangladesh CERT, CERT-EU) India is named only as suspected or linked; Pakistan's NTISB states it plainly. No source names an agency, unit or person.
Who they target
Government, military and diplomatic bodies, mainly in Pakistan and Bangladesh, also Sri Lanka and Nepal. CERT-EU reports ports and maritime facilities in 2024, and ENISA reports EU embassies.
How they usually get in
Spearphishing emails with attachments or links. In 2026 the Bangladesh CERT describes Word and PDF files from lookalike government domains that load remote content and use Office flaws from 2017.
What stands out
Reported lures copy the target country's own ministries, and 2017-era Office flaws are still used. Most government detail comes from Pakistan and Bangladesh, which are among the countries it is said to target, and no charges, sanctions or named sponsor were found.
What to do first
Patch old Microsoft Office, stop Office loading remote templates automatically, and check the real sending domain of government-themed emails.

Names

Public reports use several names for this activity.

Names used for SideWinder
NameWhere it appears
Sidewinder MITRE ATT&CK group page G0121; Pakistan NTISB Advisory 54; Bangladesh CIRT advisories[1, 3, 6]
T-APT-04 MITRE ATT&CK Associated Groups; Pakistan NTISB Advisory 54; Bangladesh CIRT alert of 4 January 2024[1, 3, 5]
Rattlesnake MITRE ATT&CK Associated Groups; Pakistan NTISB Advisory 54; Bangladesh CIRT alert of 4 January 2024[1, 3, 5]
Razor Tiger BSI list of active APT groups; Bangladesh CIRT alert of 4 January 2024[11, 5]
APT-C-17 Bangladesh CIRT alert of 4 January 2024[5]
Hardcore Nationalist (HN2) Bangladesh CIRT alert of 4 January 2024[5]

Who says so

Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.

  • MITRE ATT&CK page last modified 31 July 2026

    Describes SideWinder as a suspected Indian threat actor group, active since at least 2012.[1]

  • Pakistan NTISB undated (filed under 2022)

    Advisory 54 calls Sidewinder an Indian APT group, present since 2012. It says APTs are usually state sponsored and gives Sidewinder as an example, but names no agency.[3]

  • Pakistan National CERT undated (file 24-8)

    Calls a campaign against government bodies one "believed to be associated with" Sidewinder. The text names no country behind it.[4]

  • Bangladesh national CERT 4 January 2024

    Alert on a phishing campaign against Bangladeshi armed forces and police. Calls the group a "prolific nation-state group" active since at least 2012, with no country named in the text.[5]

  • CERT-EU October 2022

    Cyber Security Brief counts "1 Indian (codenamed SideWinder)" among state-linked actors and calls it "India-linked".[8]

  • CERT-EU July 2024

    Says SideWinder is "believed to originate from India" and aimed at espionage and intelligence gathering.[9]

  • BSI (Germany) 14 April 2026

    Lists "Sidewinder / Razor Tiger" among groups active against Germany or other European countries in the last two years. Gives no origin.[11]

  • ENISA October 2025

    Counts SideWinder among "India-nexus" intrusion sets and assesses its EU lures as likely reflecting India's interest in EU policy positions.[10]

  • Bangladesh national CERT 30 July 2026

    Describes SideWinder as having "suspected India-nexus affiliations" and assesses further targeting of Bangladesh as high likelihood.[6]

  • Bangladesh national CERT 17 September 2026

    Says evidence from a newly found server "does not conclusively establish attribution to SideWinder or a state sponsor".[7]

Where sources differ

Sources differ in how sure they sound. MITRE says "suspected Indian". Pakistan's NTISB says "Indian APT group" without hedging. The Bangladesh CERT said "nation-state group" with no country in January 2024, then "suspected India-nexus affiliations" in July 2026. CERT-EU says "India-linked" in 2022 and "believed to originate from India" in 2024, ENISA says "India-nexus", and BSI gives no origin. No source names an agency, unit or person. Pakistan and Bangladesh are also among the countries the group is said to target. On 17 September 2026 the Bangladesh CERT said evidence from one newly found server did not conclusively tie it to SideWinder or a state sponsor.

Who they target

Sectors

  • Critical government departmentsPakistan's NTISB says its incident analysis found Sidewinder footprints in critical government departments, and that it posed as NADRA and the Pakistan Air Force.[3]
  • Highest executive officesA Pakistan National CERT advisory describes phishing PDFs themed around the highest executive offices and ministries.[4]
  • Armed Forces Division and law enforcementThe Bangladesh CERT alert of 4 January 2024 names these as targets of an ongoing phishing campaign.[5]
  • At least nine government bodiesThe Bangladesh CERT says the 2026 campaign impersonates at least nine government entities and assesses further targeting as high likelihood.[6]
  • Bangladesh, Sri Lanka, Nepal, PakistanThe Bangladesh CERT says 2026 lookalike domains mimic government entities in these four countries.[6]
  • Pakistan, China, Nepal, AfghanistanMITRE says the group targets these sectors throughout Asia, mainly in these four countries.[1]
  • Mediterranean and Indian OceanCERT-EU (July 2024) reports spearphishing of port and maritime facilities in early 2024 in Pakistan, Egypt, Sri Lanka, Bangladesh, Myanmar, Nepal and the Maldives.[9]
  • EU embassiesENISA says SideWinder emerged in the EU in Q2 2024 with a focus on diplomatic entities and governmental organizations, notably embassies.[10]
  • Health, telecoms, finance, mediaThe January 2024 alert lists healthcare, telecommunication, financial institutions and news and media among target sectors.[5]
  • Administration of the StateBSI lists the group against the sector "Administration of the State and the economic and social policy of the community".[11]

Regions

  • PakistanMITRE ATT&CK says Sidewinder has been observed targeting government, military and business entities throughout Asia, primarily focusing on Pakistan, China, Nepal and Afghanistan.[1]

Operations timeline

Each entry is attributed to the group by the sources cited.

  1. 2012

    Active since at least

    MITRE says the group has been active since at least 2012. Pakistan's NTISB and the Bangladesh CERT give the same year.[1, 3, 5]

  2. 27 January 2021

    MITRE page created

    MITRE created the SideWinder group page on this date.[1]

  3. 2018

    Comes to public notice

    Pakistan's NTISB says the group came into limelight in 2018 when researchers identified its methods.[3]

  4. October 2022

    WarHaw malware

    CERT-EU reports the India-linked SideWinder using a new malware called WarHaw against Pakistan.[8]

  5. 4 January 2024

    Phishing against Bangladesh

    The Bangladesh CERT warns of an ongoing campaign against the Armed Forces Division and law enforcement agencies.[5]

  6. Early 2024

    Ports and maritime targeting

    CERT-EU (July 2024) says spearphishing hit port and maritime facilities in the Mediterranean and Indian Ocean.[9]

  7. Q2 2024

    Appears in the EU

    ENISA says SideWinder began operating in the EU in Q2 2024, mainly against embassies.[10]

  8. 2024 to 2025

    Sustained interest in Bangladesh

    The Bangladesh CERT cites earlier 2024 to 2025 activity against Bangladeshi defense, finance, telecoms and police bodies.[6]

  9. October 2025

    EU report

    ENISA calls SideWinder a newcomer among the most active state-nexus groups in the EU.[10]

  10. 14 April 2026

    Listed by BSI

    BSI lists Sidewinder / Razor Tiger as active against Germany or other European countries in the last two years.[11]

  11. 21 April 2026

    Lookalike domain campaign starts

    The Bangladesh CERT says 11 parent domains and more than 60 subdomains mimicking government bodies were set up between this date and 28 July.[6]

  12. 28 July 2026

    Campaign still running

    The Bangladesh CERT says the campaign was ongoing at the time of writing; advisory published 30 July 2026.[6]

  13. 31 July 2026

    MITRE page updated

    MITRE shows the group page last modified on this date.[1]

  14. 15 September 2026

    Exposed server found

    The Bangladesh CERT reports an exposed server of suspected SideWinder-associated infrastructure, but says evidence does not conclusively establish attribution.[7]

Government actions

Indictments, sanctions and advisories that name the group or its alleged members.

Government actions about SideWinder
DateWhoWhat
October 2022 CERT-EU Threat briefCyber Security Brief names SideWinder as an India-linked actor using WarHaw against Pakistan.[8]
undated (filed under 2022) Pakistan NTISB AdvisoryAdvisory No. 54 profiles Sidewinder and lists prevention steps such as multi-factor authentication and checking senders by a second channel.[3]
4 January 2024 Bangladesh national CERT AlertWarns of a phishing campaign against Bangladeshi armed forces and police.[5]
July 2024 CERT-EU Threat briefCyber Security Brief 24-08 reports port and maritime targeting.[9]
undated (file 24-8) Pakistan National CERT AdvisoryAdvisory NCA-08.051324 on PDF lures themed on the highest offices, with mitigations.[4]
October 2025 ENISA Threat reportNames SideWinder among India-nexus groups active against the EU.[10]
14 April 2026 BSI (Germany) Public listLists Sidewinder / Razor Tiger among active APT groups relevant to Germany.[11]
30 July 2026 Bangladesh national CERT AdvisoryDescribes the 2026 lookalike domain campaign and recommends patching Office and blocking the domains.[6]
17 September 2026 Bangladesh national CERT AdvisoryTreats a newly found server as a hunting lead and says attribution is not established.[7]
31 July 2026 MITRE ATT&CK Group page updateG0121 page version 1.2 shows its last modification as 31 July 2026.[1]

How they get in

Techniques reported for this group, by MITRE ATT&CK tactic.

Reconnaissance

  • Phishing for Information: Spearphishing Link T1598.003

    MITRE lists emails with links to credential harvesting websites; the Bangladesh CERT describes fake government and webmail log-in pages.[1, 6]

Initial Access

  • Phishing: Spearphishing Attachment T1566.001

    MITRE lists emails with malicious attachments often crafted for specific targets; the 2026 campaign uses Word and PDF files.[1, 6]

  • Phishing: Spearphishing Link T1566.002

    MITRE lists emails with malicious links; Pakistan's National CERT describes clickable links inside phishing PDFs.[1, 4]

Execution

  • User Execution: Malicious File T1204.002

    MITRE says targets are lured into opening malicious files.[1]

  • Exploitation for Client Execution T1203

    MITRE lists CVE-2017-11882 and CVE-2020-0674; the Bangladesh CERT names CVE-2017-0199 and CVE-2017-11882 in 2026.[1, 6]

  • Command and Scripting Interpreter: JavaScript T1059.007

    MITRE says JavaScript is used to drop and run malware loaders.[1]

Persistence

  • Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder T1547.001

    MITRE says paths to executables are added to the Registry to persist.[1]

Command and Control

  • Application Layer Protocol: Web Protocols T1071.001

    MITRE says HTTP is used for command and control.[1]

Exfiltration

  • Automated Exfiltration T1020

    MITRE says tools are set to send collected files automatically to attacker servers.[1]

Stealth

  • Hijack Execution Flow: DLL T1574.001

    MITRE lists DLL side-loading, including hijacking the Windows file rekeywiz.exe.[1]

  • Masquerading: Match Legitimate Resource Name or Location T1036.005

    MITRE says malicious files were named rekeywiz.exe to match a real Windows file.[1]

  • System Binary Proxy Execution: Mshta T1218.005

    MITRE says mshta.exe is used to run malicious payloads.[1]

Tools and malware

  • Koadic Post-exploitation framework

    MITRE lists this public Windows tool as software used by the group.[1, 2]

  • WarHaw Malware

    CERT-EU (October 2022) names it as new malware used against Pakistan; MITRE does not list it.[8]

  • Script loaders PowerShell, VBScript, JavaScript

    MITRE says scripts are used to drop and run malware loaders.[1]

  • rekeywiz.exe Abused Windows file

    MITRE says the group hijacked this real Windows file for DLL side-loading and named malicious files after it.[1]

  • mshta.exe Built-in Windows program

    MITRE says the group uses it to run malicious payloads.[1]

  • LNK files Shortcut files

    MITRE says the group uses Windows shortcut files to download remote files.[1]

  • Word and PDF lures Weaponized documents

    The Bangladesh CERT says 2026 DOCX and PDF files load remote content from attacker servers.[6]

  • CVE-2017-11882 and CVE-2020-0674 Software flaws

    MITRE says the group exploited these two vulnerabilities to gain execution.[1]

  • CVE-2017-0199 Office flaw

    The Bangladesh CERT says the 2026 campaign continues to exploit this Office remote template flaw, patched in 2017.[6]

  • Sliver and Vshell Command tools

    The Bangladesh CERT says a newly found server held these tools. It says this does not conclusively establish attribution to SideWinder.[7]

Detection and defense

  1. Patch old Office

    Patch Microsoft Office against CVE-2017-0199 and CVE-2017-11882, as the Bangladesh CERT advises; MITRE also lists regular software updates.

    Counters T1203

  2. Stop remote content loading

    Turn off automatic fetching of remote templates and linked data in Office through Group Policy, and use Protected View for documents from the internet.

    Counters T1566.001 T1204.002

  3. Check the sender, not the name

    Verify the real sending domain, check unexpected senders by phone or SMS as Pakistan's NTISB advises, and use SPF, DKIM and DMARC filtering.

    Counters T1566.001 T1566.002

  4. Screen Word and PDF attachments

    Quarantine and sandbox DOCX and PDF files that reach out to outside servers, filter email attachments, and do not treat a PDF as safer than a Word file.

    Counters T1566.001 T1204.002

  5. Watch lookalike domains

    Alert on new domains that copy government names or use punycode (xn--), and block known lookalike domains; MITRE also lists browser protection against homograph links.

    Counters T1566.002 T1598.003

  6. Protect log-ins

    Use multi-factor authentication on mail systems and change administrator passwords regularly, since the group sends links to credential harvesting pages.

    Counters T1598.003

  7. Limit script and DLL abuse

    Use application control to block untrusted DLLs, scripts and, where not needed, mshta.exe, and deploy endpoint detection and response.

    Counters T1574.001 T1218.005 T1059.007

  8. Train staff

    Train users to spot spearphishing and to check links before they click, with extra care for government-themed documents.

    Counters T1598.003 T1204.002

What Brandefense can do

  • Phishing Monitoring & Domain Abuse

    Spot new domains that copy your organization or government bodies, since lookalike domains are central to the reported campaigns.

  • Cyber Threat Intelligence

    Follow what MITRE and national CERTs report about this group and compare its listed techniques with your own controls.

  • Dark Web Monitoring

    Watch for company credentials that surface for sale or in leaks, since MITRE lists emails leading to credential harvesting sites.

  • Executive Protection

    See fake pages and messages that use the names of senior officials, since Pakistan's National CERT describes lures themed on the highest offices.

Questions

Who is SideWinder?

MITRE ATT&CK describes it as a suspected Indian threat actor group, active since at least 2012. Pakistan's NTISB calls it an Indian APT group, and the Bangladesh CERT says "suspected India-nexus affiliations".

Who is behind it?

Sources differ in how sure they sound, and none names an agency, unit or person. Pakistan and Bangladesh, which issued the most detail, are among the countries it is said to target.

Who does it target?

Government, military and diplomatic bodies, mainly in Pakistan and Bangladesh, and also Sri Lanka and Nepal. MITRE adds China and Afghanistan. CERT-EU reports ports and maritime facilities, and ENISA reports EU embassies.

How does it get in?

Spearphishing emails with attachments or links. In 2026 the Bangladesh CERT describes Word and PDF files that load remote content and old Office flaws, sent from lookalike government domains.

Has anyone been charged or sanctioned?

None of the sources opened reports an indictment, sanction or reward.

What should I do first?

Patch old Microsoft Office, stop Office loading remote templates automatically, and check the real sending domain of government-themed emails.

In our research

  1. Moonlight Tiger (APT-C-09, Patchwork, Dropping Elephant): India’s Silent Espionage Arm in the Digital Battlefield December 2025
  2. RAZOR TIGER: The Persistent South Asian Espionage Threat November 2025
  3. APT Groups in the MENA Region: Key Threat Actors in Cyber Espionage October 2025
  4. Perspective of the Month | APT Groups | May 2023 June 2023

Sources

  1. SideWinder, Group G0121 MITRE ATT&CK Supports: Names, description, techniques, version and dates
  2. Koadic, Software S0250 MITRE ATT&CK Supports: The one tool MITRE lists for the group
  3. Cyber Security Advisory, Cyber Attacks Against Pakistan by Sidewinder APT Group (Advisory No. 54) Pakistan NTISB, copy hosted by the Federal Board of Revenue Supports: Profile, targets, masquerading, prevention steps
  4. NCERT Advisory NCA-08.051324, Sidewinder APT Campaign Targeting Government Organizations Pakistan National CERT Supports: PDF lures, technique list, mitigations
  5. Cyber Threat Alert, Ongoing Phishing Campaign Targeting Bangladesh (4 January 2024) BGD e-GOV CIRT, Bangladesh Supports: Campaign against Bangladeshi armed forces and police, alias list, sectors
  6. SideWinder Spear-Phishing Campaign Against Bangladesh Leveraging Dual-Format Weaponized Documents BGD e-GOV CIRT, Bangladesh Supports: 2026 campaign, lookalike domains, old Office flaws, mitigations
  7. SideWinder-Associated Campaign Targeting South Asian Government and Financial Infrastructure BGD e-GOV CIRT, Bangladesh Supports: Caution that evidence does not establish attribution
  8. CERT-EU Cyber Security Brief, October 2022 CERT-EU Supports: WarHaw malware against Pakistan, India-linked wording
  9. CERT-EU Cyber Security Brief 24-08, July 2024 CERT-EU Supports: Ports and maritime targeting, countries, origin wording
  10. ENISA annual EU threat report, October 2025 ENISA Supports: EU public administrations and embassies, India-nexus wording
  11. Active APT groups in Germany BSI, Germany Supports: Listing as Sidewinder / Razor Tiger, 14 April 2026
  12. Phishing: Spearphishing Attachment (T1566.001) MITRE ATT&CK Supports: Mitigations
  13. Phishing: Spearphishing Link (T1566.002) MITRE ATT&CK Supports: Mitigations
  14. Phishing for Information: Spearphishing Link (T1598.003) MITRE ATT&CK Supports: Mitigations
  15. Exploitation for Client Execution (T1203) MITRE ATT&CK Supports: Mitigations
  16. User Execution: Malicious File (T1204.002) MITRE ATT&CK Supports: Mitigations
  17. Hijack Execution Flow: DLL (T1574.001) MITRE ATT&CK Supports: Mitigations
  18. System Binary Proxy Execution: Mshta (T1218.005) MITRE ATT&CK Supports: Mitigations
  19. Command and Scripting Interpreter: JavaScript (T1059.007) MITRE ATT&CK Supports: Mitigations

Other groups

All groups

Andariel

Attributed by the US, UK and South Korean governments to North Korea's Reconnaissance General Bureau, Andariel is described in a July 2024 joint advisory as stealing defense, aerospace and nuclear secrets and funding that work with ransomware against US healthcare. MITRE ATT&CK describes it as a sub-set of Lazarus Group; the advisory does not use that term.

Attributed by the US, UK and South Korean governments, and MITRE ATT&CK

  • KPAttributed to North Korea
Active since 2009 Full profile

APT-C-60

APT-C-60 is the name JPCERT/CC uses for a threat group it says likely carried out spear-phishing attacks on organizations in Japan from August 2024, using fake job-applicant emails and a backdoor called SpyGlace. No government or MITRE source opened for this page says who is behind it.

Short profile

APT1

Also known as Comment Crew · Comment Panda · Comment Group

Attributed by MITRE ATT&CK to PLA Unit 61398 in China, APT1 is the subject of a US indictment of 19 May 2014 charging five Unit 61398 officers with hacking six US organizations. The Department of Justice alleges the aim was commercial gain for China's state-owned firms.

Attributed by the US Department of Justice (indictment of 19 May 2014) and MITRE ATT&CK

  • CNAttributed to China
Active since 2006 Full profile

Keep exploring

Knowledge Hub

Glossary term

MITRE ATT&CK

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Read more

Glossary term

Multi-factor authentication (MFA)

Multi-factor authentication (MFA) is a way to log in that needs two or more different kinds of proof, such as a password and a code from an authentication app.

Read more

Technique

Phishing (T1566): ATT&CK Technique

Phishing is when an attacker sends a message that tricks someone into opening a malicious file, following a link or giving away a password.

Read more