Trusted Design

Sidewinder

アクターID: G0121

· MITRE Pageへのリンク

脅威アクターの詳細

Sidewinder is a suspected Indian threat actor group that has been active since at least 2012. They have been observed targeting government, military, and business entities throughout Asia, primarily focusing on Pakistan, China, Nepal, and Afghanistan.(Citation: ATT Sidewinder January 2021)(Citation: Securelist APT Trends April 2018)(Citation: Cyble Sidewinder September 2020)

脅威アクターの別名・別称

Sidewinder
T-APT-04
Rattlesnake

利用した攻撃手法

• T1557 - Adversary-in-the-Middle
• T1491.002 - External Defacement
• T1546.013 - PowerShell Profile
• T1116 - Code Signing
• T1218.013 - Mavinject
• T1206 - Sudo Caching
• T1087.002 - Domain Account
• T1543.003 - Windows Service
• T1566.002 - Spearphishing Link
• T1598.003 - Spearphishing Link
• T1089 - Disabling Security Tools
• T1487 - Disk Structure Wipe
• T1120 - Peripheral Device Discovery
• T1590.006 - Network Security Appliances
• T1090 - Proxy
• T1219.001 - IDE Tunneling
• T1218.012 - Verclsid
• T1657 - Financial Theft
• T1583.006 - Web Services
• T1497.002 - User Activity Based Checks
• T1679 - Selective Exclusion
• T1218.010 - Regsvr32
• T1506 - Web Session Cookie
• T1601.001 - Patch System Image
• T1556.005 - Reversible Encryption
• T1027.010 - Command Obfuscation
• T1159 - Launch Agent
• T1547.013 - XDG Autostart Entries
• T1027.018 - Invisible Unicode
• T1578.001 - Create Snapshot

関連するCVE (攻撃手法に関連)

• CVE-2013-6282 (T1218.012)
• CVE-2016-1898 (T1027.018)
• CVE-2016-1897 (T1027.018)
• CVE-2015-0932 (T1657)
• CVE-2014-0322 (T1027.018)
• CVE-2015-2419 (T1027.018)
• CVE-2016-0189 (T1027.018)
• CVE-2014-4114 (T1027.018)
• CVE-2015-1770 (T1027.018)
• CVE-2012-1856 (T1027.018)
• CVE-2015-2545 (T1027.018)
• CVE-2014-6332 (T1027.018)
• CVE-2017-0199 (T1027.018)
• CVE-2015-2424 (T1027.018)
• CVE-2015-0097 (T1027.018)
• CVE-2012-0158 (T1027.018)
• CVE-2014-1761 (T1218.010)
• CVE-2015-1641 (T1027.018)
• CVE-2017-0261 (T1027.018)
• CVE-2017-0262 (T1027.018)
• CVE-2013-3906 (T1601.001)
• CVE-2014-6352 (T1027.010)
• CVE-2010-3333 (T1027.018)
• CVE-2012-2539 (T1027.018)
• CVE-2010-0806 (T1027.018)
• CVE-2017-8570 (T1027.018)
• CVE-2015-0016 (T1027.018)
• CVE-2010-0188 (T1027.018)
• CVE-2010-2884 (T1218.012)
• CVE-2013-0640 (T1218.012)
• CVE-2011-0611 (T1218.010)
• CVE-2015-0071 (T1027.018)
• CVE-2015-5119 (T1027.018)
• CVE-2015-5122 (T1027.018)
• CVE-2015-1427 (T1218.012)
• CVE-2015-2546 (T1027.018)
• CVE-2015-3785 (T1657)
• CVE-2015-5897 (T1218.012)
• CVE-2015-7645 (T1027.018)
• CVE-2017-12149 (T1027.018)
• CVE-2015-3043 (T1027.018)
• CVE-2015-3456 (T1657)
• CVE-2015-3090 (T1027.018)
• CVE-2010-1553 (T1027.018)
• CVE-2015-3113 (T1218.010)
• CVE-2015-2590 (T1027.018)
• CVE-2015-5477 (T1218.012)
• CVE-2015-4495 (T1218.010)
• CVE-2015-2502 (T1027.018)
• CVE-2014-6271 (T1027.018)
• CVE-2013-2094 (T1027.018)
• CVE-2014-4113 (T1027.018)
• CVE-2015-8562 (T1027.018)
• CVE-2015-7808 (T1218.010)
• CVE-2012-1889 (T1218.012)
• CVE-2016-1990 (T1218.012)
• CVE-2016-1991 (T1218.012)
• CVE-2016-1010 (T1027.018)
• CVE-2016-1019 (T1657)
• CVE-2016-0984 (T1027.018)
• CVE-2016-1001 (T1218.010)
• CVE-2016-0998 (T1027.018)
• CVE-2015-1701 (T1027.018)
• CVE-2015-0313 (T1027.018)
• CVE-2015-0359 (T1027.018)
• CVE-2014-0329 (T1027.018)
• CVE-2015-5130 (T1027.018)
• CVE-2015-5134 (T1027.018)
• CVE-2015-5539 (T1027.018)
• CVE-2015-5557 (T1027.018)
• CVE-2015-5563 (T1027.018)
• CVE-2015-5559 (T1027.018)
• CVE-2015-5540 (T1027.018)
• CVE-2015-5561 (T1027.018)
• CVE-2015-5551 (T1027.018)
• CVE-2015-5564 (T1027.018)
• CVE-2015-5565 (T1027.018)
• CVE-2015-5550 (T1027.018)
• CVE-2015-5566 (T1027.018)
• CVE-2015-5127 (T1027.018)
• CVE-2015-5556 (T1027.018)
• CVE-2015-5749 (T1657)
• CVE-2015-3628 (T1218.010)
• CVE-2015-6034 (T1566.002)
• CVE-2015-2852 (T1027.018)
• CVE-2015-2854 (T1027.018)
• CVE-2015-2853 (T1027.018)
• CVE-2015-7755 (T1218.010)
• CVE-2012-4969 (T1027.018)
• CVE-2016-1287 (T1657)
• CVE-2015-7261 (T1027.018)
• CVE-2015-6036 (T1027.018)
• CVE-2015-6022 (T1027.018)
• CVE-2015-7262 (T1218.012)
• CVE-2015-8286 (T1657)
• CVE-2015-8287 (T1218.010)
• CVE-2016-1562 (T1218.012)
• CVE-2016-2342 (T1218.012)
• CVE-2016-2343 (T1218.012)
• CVE-2017-0263 (T1027.018)
• CVE-2016-6532 (T1218.012)
• CVE-2016-9494 (T1027.018)
• CVE-2016-9496 (T1027.018)
• CVE-2016-9495 (T1027.018)
• CVE-2017-3212 (T1657)
• CVE-2025-55182 (T1027.018)
• CVE-2025-61882 (T1566.002)
• CVE-2015-0311 (T1027.018)
• CVE-2012-0056 (T1657)
• CVE-2010-3081 (T1657)
• CVE-2012-3213 (T1027.018)
• CVE-2012-4792 (T1027.018)
• CVE-2012-1258 (T1219.001)
• CVE-2015-0336 (T1027.018)
• CVE-2011-3544 (T1027.018)
• CVE-2014-3153 (T1218.010)
• CVE-2014-7911 (T1218.012)
• CVE-2014-4322 (T1218.012)
• CVE-2015-3636 (T1218.012)
• CVE-2015-3105 (T1218.010)
• CVE-2014-0497 (T1218.010)
• CVE-2014-8361 (T1556.005)
• CVE-2017-16929 (T1027.018)
• CVE-2017-17215 (T1027.018)
• CVE-2013-0074 (T1027.018)
• CVE-2012-0507 (T1027.018)
• CVE-2013-2465 (T1027.018)
• CVE-2014-8439 (T1657)
• CVE-2013-2551 (T1027.018)
• CVE-2014-0569 (T1219.001)
• CVE-2014-0515 (T1218.010)
• CVE-2015-0310 (T1218.010)
• CVE-2012-4681 (T1578.001)
• CVE-2014-1776 (T1027.018)
• CVE-2014-0556 (T1027.018)
• CVE-2012-1876 (T1027.018)
• CVE-2015-5560 (T1219.001)
• CVE-2015-0057 (T1027.018)
• CVE-2014-9163 (T1218.010)
• CVE-2012-1723 (T1027.018)
• CVE-2015-1761 (T1027.018)
• CVE-2014-8440 (T1027.018)
• CVE-2013-3660 (T1027.018)
• CVE-2010-1297 (T1027.018)
• CVE-2013-7331 (T1218.012)
• CVE-2015-2360 (T1027.018)
• CVE-2014-4148 (T1027.018)
• CVE-2011-3402 (T1027.018)
• CVE-2014-6324 (T1027.018)
• CVE-2010-2883 (T1218.012)
• CVE-2013-0634 (T1218.012)
• CVE-2014-7247 (T1027.018)
• CVE-2012-5054 (T1218.012)
• CVE-2013-2678 (T1027.018)
• CVE-2010-0738 (T1657)
• CVE-2015-2426 (T1027.018)
• CVE-2008-1436 (T1583.006)
• CVE-2010-0232 (T1027.018)
• CVE-2010-4398 (T1027.018)
• CVE-2013-0641 (T1218.012)
• CVE-2014-3393 (T1657)
• CVE-2012-6422 (T1657)
• CVE-2013-2595 (T1657)
• CVE-2014-2273 (T1218.012)
• CVE-2015-4902 (T1027.018)
• CVE-2015-2387 (T1027.018)
• CVE-2009-3129 (T1027.018)
• CVE-2011-1255 (T1027.018)
• CVE-2013-5990 (T1027.018)
• CVE-2012-0611 (T1027.018)
• CVE-2016-4117 (T1218.010)
• CVE-2017-0001 (T1027.018)
• CVE-2017-7255 (T1218.012)
• CVE-2017-0143 (T1027.018)
• CVE-2023-1389 (T1027.018)
• CVE-2025-13335 (T1218.012)
• CVE-2025-13927 (T1218.012)
• CVE-2025-13928 (T1657)
• CVE-2025-24893 (T1027.018)
• CVE-2025-31125 (T1027.018)
• CVE-2025-34026 (T1027.018)
• CVE-2025-54313 (T1566.002)
• CVE-2025-55183 (T1027.018)
• CVE-2025-55184 (T1027.018)
• CVE-2025-68645 (T1027.018)
• CVE-2026-0723 (T1657)
• CVE-2026-1102 (T1218.012)
• CVE-2026-20127 (T1027.018)
• CVE-2014-3897 (T1027.018)
• CVE-2010-2572 (T1027.018)
• CVE-2025-66478 (T1657)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る