SideWinder Threat Group: Maritime and Nuclear Sectors at Risk with Updated Toolset

SideWinder, also known as Rattlesnake or T-APT-04, is an advanced persistent threat group that has been active since at least 2012 and is believed to originate from India. Traditionally targeting government, military, and business entities across Asia, the group has recently broadened its focus. It now intensifies attacks on maritime and logistics sectors in South and Southeast Asia, the Middle East, and Africa while also showing a marked interest in nuclear power plants and energy institutions [2]​. A hallmark of SideWinder is its rapid adaptation to security detections, as it monitors when security solutions identify its tools and modifies its malware, often within hours, to evade detection. 

In this analysis, we examine the tactics, techniques, and procedures (TTPs) employed by the SideWinder group, providing detailed insights into their methods of compromise, lateral movement, data exfiltration strategies, and recommended defensive measures to mitigate their threat.​

Analyzing SideWinder Threat Group's Advanced Tactics, Techniques, and Procedures (TTPs)

This section provides a comprehensive analysis of these TTPs, offering insights into how SideWinder and its malware infection kill chain operates, along with the tools it employs.

Initial Access Methods

Phishing: Spear-Phishing Attachments (MITRE T1566.001) 

SideWinder primarily gains initial access via targeted phishing emails carrying malicious attachments​. 

Security researchers observed that, in recent campaigns, SideWinder has crafted malicious Microsoft Office documents (such as DOCX files) that leverage Remote Template Injection (T1221). Here’s a brief breakdown of the process.

• Remote Template Injection: The DOCX is engineered to include a payload that triggers the retrieval of an external template, specifically, an RTF file, from an attacker-controlled server. This facilitates the subsequent execution of malicious operations.

• Triggering the Vulnerability: When the victim opens the document, Office automatically retrieves the remote RTF file. This file is crafted to exploit a known vulnerability in the Equation Editor (CVE-2017-11882) [1].

• Code Execution: Exploiting the Equation Editor vulnerability allows the malicious RTF to execute arbitrary code on the victim’s system, effectively giving the attacker control or the ability to further compromise the system.

Targeting Maritime and Nuclear Sectors: Themed Lure Documents 

The phishing lures are highly tailored to the targets, increasing the likelihood of success. In late 2024, SideWinder executed a campaign by disseminating documents masqueraded as authentic communications from the maritime and nuclear sectors. 

For instance, the decoy documents were crafted to mimic port authority briefings, HR reports within shipping and logistics, and announcements for nuclear energy committee meetings.

Figure is taken from here.

By mirroring content from real organizations and current events, the group tricks victims into believing the attachment is benign and urgent, prompting them to open it. This User Execution (T1204) via social engineering is a first step in SideWinder’s attack chain.

Execution and Persistence Techniques

Multi-Stage Malware Delivery 

When a victim opens the malicious document (phishing attachment), an embedded exploit initiates a multi-stage execution chain. The Equation Editor RTF exploit triggers shellcode that launches the Windows HTML Application host (mshta.exe, MITRE T1218.005). This process retrieves a malicious HTA file from an attacker-controlled server.

The technique uses Signed Binary Proxy Execution (T1218) by leveraging a trusted system binary to execute harmful HTML/JavaScript in a stealthy manner. The downloaded HTA file contains heavily obfuscated JavaScript and operates in two stages:

• Stage 1: The script decodes hidden payloads and performs environment checks, such as verifying that the system has more than 950 MB of RAM to evade sandbox detection.

• Stage 2: It loads a .NET-based Downloader Module into memory. This module gathers system information and fetches the next payload stage.

The entire chain executes in memory and uses legitimate processes (like mshta and the .NET CLR) to minimize detection by security mechanisms.

Backdoor Installation via DLL Side-Loading (T1574.002) 

The final payload is a custom backdoor loader that SideWinder persistently installs using DLL side-loading. 

In the module installer stage [1], a malicious DLL, dubbed the “Backdoor Loader” (see how Picus helps below), is dropped alongside a legitimate, signed application on the victim host. The malicious DLL is named after a legitimate library. This hijacks the normal DLL search order, causing the trusted application to load the malicious code. 

Picus Security Control Validation (SCV) Validating SideWinder Backdoor Loaders

In past campaigns, the loader was named propsys.dll or vsstrace.dll to pair with specific programs.

In the 2024 campaigns, SideWinder diversified this technique by using the following file names. 

When the legitimate application runs, either at system startup or as a service, it sideloads the fake DLL. The fake DLL then injects or launches the espionage implant in memory. This method provides persistent access (Persistence via Hijacked Execution Flow, T1547/1574) while blending in with normal system binaries.

StealerBot Implant (Post-Exploitation Toolkit) 

The backdoor ultimately loaded in memory is SideWinder’s private post-exploitation toolkit known as StealerBot​. 

StealerBot is a modular backdoor designed for espionage – it never touches the disk in decrypted form, as it’s injected directly by the loader​. Once running, an Orchestrator component within StealerBot maintains communication with command-and-control and can deploy various plug-in modules on demand​. The implant’s capabilities are loaded modularly, enabling SideWinder to execute a wide range of actions on the compromised system while remaining stealthy and persistent in memory.

Defense Evasion and Privilege Escalation

Obfuscation & Sandbox Evasion (T1027, T1497) 

SideWinder implements advanced anti-analysis techniques to avoid detection. The malicious HTA and JavaScript payloads are extensively obfuscated to complicate analysis. 

It also attempts to load a non-existent library (such as nlssorting.dll) and aborts if the load succeeds, a behavior observed in some sandbox environments. The final loader code undergoes further obfuscation through control-flow flattening to impede reverse engineering.

Security Software Checks (T1518.001 – Security Software Discovery) 

A key aspect of SideWinder’s evasion strategy is its ability to identify endpoint security measures. 

The .NET-based downloader module gathers information on installed security solutions using WMI queries and cross-references active processes with a predefined list of antivirus and EDR process names.

If specific security software is identified, the malware may alter its execution flow or suppress certain actions to minimize detection risk. This dynamic approach to defense evasion is a defining characteristic of SideWinder’s tactics.

Rapid Tool Modification 

SideWinder operators consistently update their tools to bypass detection. They monitor when security solutions flag their malware or tactics and respond quickly by modifying code or adjusting techniques. Changes are often made within hours.

To evade antivirus signatures and behavioral analysis, they frequently recompile binaries, rename components, and alter file paths or loader names. This ongoing evolution creates a constant battle between attackers and defenders, allowing SideWinder to stay ahead of security patches and detection mechanisms.

Privilege Escalation via UAC Bypass (T1548.002) 

After gaining access to a system, SideWinder works to expand its presence in the compromised environment. The StealerBot toolkit includes modules designed for privilege escalation, including a User Account Control (UAC) bypass that enables the malware to run with elevated privileges without requiring user approval.

By circumventing UAC prompts, the malware can silently perform administrative tasks such as installing services or deploying additional payloads. 

Another module, known as the Token Grabber, appears capable of stealing or impersonating access tokens from other processes or users. This aligns with Access Token Manipulation (T1134), allowing the attacker to escalate privileges or operate within different user contexts. 

Credential Theft for Escalation 

Several StealerBot components are designed to capture credentials. Plugins enable keylogging, password theft from web browsers, and phishing for Windows credentials using fake prompts.

By collecting credentials, including administrative passwords or domain accounts, SideWinder can extend its access beyond the initially compromised user. The toolkit’s ability to intercept RDP credentials allows attackers to capture admin logins and use them to escalate privileges or move laterally across systems. 

Exploiting valid credentials is a core tactic, helping SideWinder expand its reach while blending in with legitimate activity to evade detection.

Lateral Movement, Command & Control, and Exfiltration

Lateral Movement via Stolen Credentials (T1078, T1021) 

SideWinder’s emphasis on credential theft directly enables lateral movement within targeted networks. With access to valid credentials—particularly administrative, VPN, or RDP logins—the attackers can authenticate as legitimate users and navigate through maritime or nuclear infrastructure. Stolen RDP credentials, in particular, allow remote access to critical systems, furthering their espionage efforts.

Although specific instances of lateral movement in recent campaigns have not been publicly disclosed, the presence of an RDP credential-stealer and token impersonation module suggests SideWinder leverages standard IT administration tools and protocols, such as RDP, SMB, and Windows admin shares, to spread. By exploiting Remote Services (T1021) with legitimate credentials, they can traverse network segments without relying on malware-based exploits, making detection more challenging.

Command-and-Control over HTTP(S) (T1071.001) 

SideWinder’s backdoor communication leverages common web protocols to evade detection. The StealerBot Orchestrator establishes two primary C2 channels: one for retrieving new modules or commands and another for exfiltrating stolen data. These channels use HTTP or HTTPS, allowing them to blend in with normal web traffic.

Each infected host regularly beacons to a C2 Modules URL to fetch instructions or plugin updates, while a separate C2 Gateway URL is used to transmit harvested data. All C2 traffic is encrypted, with the implant embedding an RSA key to secure communication. So, this also aligns with Encrypted C2 Channels (T1573), ensuring that even if traffic is flagged, its contents remain concealed.

Data Collection & Exfiltration (T1041) 

As an espionage group, SideWinder prioritizes stealthy data theft from victim systems. Once StealerBot is in place, it can collect a wide range of sensitive data via its modules: 

• screenshots of the desktop, 

• keylogged keystrokes, 

• saved browser passwords, 

• documents and files of interest, and 

• even microphone or webcam data if configured​. 

These items are typically gathered in temporary storage (or kept in memory buffers) by the malware. Exfiltration is then performed through the encrypted C2 channel (often the “Gateway” HTTP channel) – effectively Exfiltration Over C2 Channel using the backdoor’s communication link​. 

For example, when the File Stealer or Screenshot Grabber modules run, the captured files are uploaded back to SideWinder’s servers via HTTP POST requests disguised as normal traffic​. Because the exfiltration traffic is intermixed with legitimate web traffic and encrypted, it is difficult for network defenders to spot. Over the last six months, SideWinder has used this approach to steal sensitive information from maritime and nuclear sector victims without immediate detection [2]​. 

The combination of stealthy collection and surreptitious exfiltration ensures the threat actors obtain the intelligence they seek (e.g. strategic plans, credentials, communications) while remaining under the radar for an extended period.

How Does Picus Help Against the SideWinder Threat Group Campaigns?

We strongly suggest simulating ransomware groups to test the effectiveness of your security controls against their attacks using the Picus Security Validation Platform.  

Picus Threat Library includes the following threats for SideWinder threat group and their backdoor loaders.

Defense Strategies Against the SideWinder Threat Group's Attacks

To mitigate the impact of SideWinder attack campaigns, organizations should adopt a layered defense approach:

Deploy Advanced Endpoint Detection and Response (EDR) Solutions

Invest in robust EDR tools that continuously monitor endpoints for suspicious activities—such as abnormal PowerShell usage or unexpected script executions—and provide real-time remediation. This early detection can help contain threats before they spread.

Continuously Test and Validate Security Controls

Given the evolving and adaptive tactics of the SideWinder threat group, organizations must regularly assess the effectiveness of their defenses. Use Breach and Attack Simulation (BAS) solutions, such as the Picus Security Control Validation (SCV) solution, to emulate real-world attack scenarios—ranging from initial phishing attempts and exploitation of public-facing applications to the deployment of malicious PowerShell scripts and command-and-control (C2) communications. These proactive tests help identify control gaps and provide actionable recommendations to strengthen your security posture.

Implement Network Segmentation and a Zero Trust Model

Segment your network to limit lateral movement in the event of a breach. Embrace a Zero Trust security model that continuously verifies every user and device, ensuring that even if an attacker gains access, the damage is contained within a limited segment of your network.

Maintain Regular, Immutable Offline Backups and an Incident Response Plan

Ensure that critical data is regularly backed up and stored offline in an immutable format to prevent tampering during an attack. Develop and routinely test an incident response plan that clearly defines roles, responsibilities, and procedures for rapid containment, eradication, and recovery in the event of a ransomware incident.

References

[1] G. Dedola, “SideWinder targets the maritime and nuclear sectors with an updated toolset,” Kaspersky, Mar. 10, 2025. Available: https://securelist.com/sidewinder-apt-updates-its-toolset-and-targets-nuclear-sector/115847/. [Accessed: Mar. 17, 2025]

[2] “Website.” Available: https://www.darkreading.com/cyberattacks-data-breaches/sidewinder-wide-geographic-net-attack-spree