Sidewinder
- ID
- G0121
- Associated names
- T-APT-04, Rattlesnake
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
Sidewinder is a suspected Indian threat actor group that has been active since at least 2012. They have been observed targeting government, military, and business entities throughout Asia, primarily focusing on Pakistan, China, Nepal, and Afghanistan.[1][2][3]
Techniques used (30)
- T1016 System Network Configuration Discovery
- T1020 Automated Exfiltration
- T1027.010 Command Obfuscation
- T1027.013 Encrypted/Encoded File
- T1033 System Owner/User Discovery
- T1036.005 Match Legitimate Resource Name or Location
- T1057 Process Discovery
- T1059.001 PowerShell
- T1059.005 Visual Basic
- T1059.007 JavaScript
- T1071.001 Web Protocols
- T1074.001 Local Data Staging
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1105 Ingress Tool Transfer
- T1119 Automated Collection
- T1124 System Time Discovery
- T1203 Exploitation for Client Execution
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1218.005 Mshta
- T1518 Software Discovery
- T1518.001 Security Software Discovery
- T1547.001 Registry Run Keys / Startup Folder
- T1559.002 Dynamic Data Exchange
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1574.001 DLL
- T1598.002 Spearphishing Attachment
- T1598.003 Spearphishing Link