Pierluigi Paganini
March 11, 2025
Kaspersky researchers warn that the APT group SideWinder (also known as Razor Tiger, Rattlesnake, and T-APT-04) is targeting maritime, logistics, nuclear, telecom, and IT sectors across South Asia, Southeast Asia, the Middle East, and Africa.
SideWinder (also known as Razor Tiger, Rattlesnake, and T-APT-04) has been active since at least 2012, the group mainly targeted Police, Military, Maritime, and the Naval forces of Central Asian countries. In the 2022 attacks, the threat actors also targeted departments of Foreign Affairs, Scientific and Defence organisations, Aviation, IT industry, and Legal firms.
The threat actor maintains a large C2 infrastructure composed of more than 400 domains and subdomains that were used to host malicious payloads and control them.
Kaspersky observed SideWinder expanding its attacks in 2024, with growing activity in Egypt, Asia, and Africa.
Some of the attacks observed by the Russian cybersecurity firm show a focus on nuclear power plants and nuclear energy in South Asia and further expansion of activities into new African countries.
SideWinder rapidly adapts to security detections, modifying malware within hours, altering tactics, techniques, and procedures. The group was spotted changing file names to maintain persistence and evade defense.
“Once their tools are identified, they respond by generating a new and modified version of the malware, often in under five hours. If behavioral detections occur, SideWinder tries to change the techniques used to maintain persistence and load components. Additionally, they change the names and paths of their malicious files.” reads the report published by Kaspersky. “Thus, monitoring and detection of the group’s activities reminds us of a ping-pong game.”
The infection pattern observed in the second part of 2024 is consistent with the one described in the previous article.
The infection flow is the same as past attacks, threat actors send spear-phishing emails with a DOCX file attached. The document loads an RTF template file stored on a remote server controlled by the attacker. The file exploits a Microsoft Office Memory Corruption flaw, tracked as CVE-2017-11882, to run a malicious shellcode and initiate a multi-level infection process. The final stage of the attack chain is a malware dubbed “Backdoor Loader” which loads a custom post-exploitation toolkit named “StealerBot”.
“During the investigation, we found a new C++ version of the “Backdoor Loader” component. The malware logic is the same as that used in the .NET variants, but the C++ version differs from the .NET implants in that it lacks anti-analysis techniques. Furthermore, most of the samples were tailored to specific targets, as they were configured to load the second stage from a specific file path embedded in the code, which also included the user’s name.” continues the report. “It indicates that these variants were likely used after the infection phase and manually deployed by the attacker within the already compromised infrastructure, after validating the victim.”
Most detected bait documents focused on government and diplomatic matters, though some covered generic topics like car rentals, real estate, and freelance job offers.
“SideWinder is a very active and persistent actor that is constantly evolving and improving its toolkits. Its basic infection method is the use of an old Microsoft Office vulnerability, CVE-2017-11882, which once again emphasizes the critical importance of installing security patches.” concludes the report. “Despite the use of an old exploit, we should not underestimate this threat actor. In fact, SideWinder has already demonstrated its ability to compromise critical assets and high-profile entities, including those in the military and government.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, newsletter)
