SideWinder, aka T-APT-04 or RattleSnake, is one of the most prolific APT groups that began its activities in 2012 and was first publicly mentioned by us in 2018. Over the years, the group has launched attacks against high-profile entities in South and Southeast Asia. Its primary targets have been military and government entities in Pakistan, Sri Lanka, China and Nepal.
Over the years, SideWinder has carried out an impressive number of attacks and its activities have been extensively described in various analyses and reports published by different researchers and vendors, one of the latest of which was released at the end of July 2024. The group may be perceived as a low-skilled actor due to the use of public exploits, malicious LNK files and scripts as infection vectors, and the use of public RATs, but their true capabilities only become apparent when you carefully examine the details of their operations.
Read more…
Source: Kaspersky
Related:
- A cascade of compromise: unveiling Lazarus’ new campaign
October 27, 2023
Earlier this year, a software vendor was compromised by the Lazarus malware delivered through unpatched legitimate software. What’s remarkable is that these software vulnerabilities were not new, and despite warnings and patches from the vendor, many of the vendor’s systems continued to use the flawed software, allowing the threat actor to exploit them. Upon further investigation, ...
- Increasing transparency in AI security
October 26, 2023
New AI innovations and applications are reaching consumers and businesses on an almost-daily basis. Building AI securely is a paramount concern, and we believe that Google’s Secure AI Framework (SAIF) can help chart a path for creating AI applications that users can trust. Today, we’re highlighting two new ways to make information about AI supply ...
- ‘iLeakage’ Attack Can Force Apple Safari To Reveal Passwords
October 26, 2023
A group of academic researchers has developed a speculative execution attack named “iLeakage” that can extract sensitive data, such as passwords and emails, on recent Apple devices via the Safari web browser. iLeakage has been developed by a team of academics from Georgia Tech, the University of Michigan, and Ruhr University Bochum after extensive examination of ...
- Kansas court system down nearly 2 weeks in `security incident’ that has hallmarks of ransomware
October 26, 2023
Kansas officials are calling a massive computer outage that’s kept most of the state’s courts offline for two weeks a “security incident” and, while they have provided no explanation, experts say it has all the hallmarks of a ransomware attack. The disruption has left attorneys unable to search online records and forced them to file motions ...
- China crackdown on cyber scams in Southeast Asia nets thousands but leaves networks intact
October 26, 2023
Zhang Hongliang, a former restaurant manager in central China, took various gigs in and outside China to support his family after losing his job during the COVID-19 pandemic. In March, a job offer to teach Chinese cooking at a restaurant led him into a cyber scam compound in Myanmar, where he was instead ordered to ...
- FBI: Threats Associated with the Israel-HAMAS Conflict
October 26, 2023
The Department of Homeland Security (DHS) and Federal Bureau of Investigation (FBI) are issuing this Public Service Announcement to highlight potential threats in the United States from a variety of actors in response to the HAMAS attacks on Israel on 7 October and subsequent activities in the region, including additional calls by foreign terrorist organizations ...