SideWinder, aka T-APT-04 or RattleSnake, is one of the most prolific APT groups that began its activities in 2012 and was first publicly mentioned by us in 2018. Over the years, the group has launched attacks against high-profile entities in South and Southeast Asia. Its primary targets have been military and government entities in Pakistan, Sri Lanka, China and Nepal.
Over the years, SideWinder has carried out an impressive number of attacks and its activities have been extensively described in various analyses and reports published by different researchers and vendors, one of the latest of which was released at the end of July 2024. The group may be perceived as a low-skilled actor due to the use of public exploits, malicious LNK files and scripts as infection vectors, and the use of public RATs, but their true capabilities only become apparent when you carefully examine the details of their operations.
Read more…
Source: Kaspersky
Related:
- Paracetamol maker Granules India’ Q1 profit hurt by cyber attack disruptions
August 9, 2023
Granules India Ltd the maker of paracetamol and ibuprofen pain relievers, reported a 62.5% fall in first-quarter profit on Wednesday, as a cyber security incident significantly disrupted operations. The generic drug maker’s consolidated net profit tumbled to 478.9 million rupees ($5.8 million) in the April-June quarter, from 1.27 billion rupees a year earlier. Granules faced a ...
- Northern Ireland: Major data breach identifies thousands of police officers and civilian staff
August 8, 2023
The Police Service of Northern Ireland (PSNI) has apologised for mistakenly revealing details of all its 10,000 staff. NI’s Police Federation said the breach could cause “incalculable damage”. In response to a Freedom of Information (FoI) request, the PSNI had shared names of all police and civilian personnel, where they were based and their roles. The ...
- UK Elections watchdog targeted by cyber attack which left voters’ details exposed
August 8, 2023
Details of tens of millions of voters could have been accessed by hackers who targeted the elections watchdog. The Electoral Commission revealed on Tuesday it was targeted by a cyber attack which allowed “hostile actors” to access electoral registers. The hack allowed the attackers to access reference copies of electoral registers which contained the name and addresses ...
- Clustering attacker behavior reveals hidden patterns
August 8, 2023
A collection of very specific behaviors, observed by Sophos X-Ops incident response analysts in the lead-up to four separate ransomware attacks in the first quarter of 2023, indicates an unexpected connection between the attacks. In the parlance of the Managed Detection and Response (MDR) team, the peculiarly similar details constitute a threat activity cluster that ...
- New cyberattack method: tracking typing remotely via keyboard sounds
August 7, 2023
A group of British cybersecurity researchers has figured out a novel new attack method: recording the sound a computer keyboard makes. The researcher took recordings using a nearby smartphone of typists and used it to train a sound classification model, achieving accuracies of 95% to suss out the actual keys pressed. They call this an acoustic side ...
- Ukraine-Linked Group Claims It Hacked Website Of Moscow Property Registration Bureau
August 7, 2023
A Ukraine-linked hacker group said on Telegram on August 7 that it had hacked the website of Moscow’s municipal property registration bureau (MosgorBTI) overnight, saying “the information about state officials, politicians, military, and special services officers who support the Ukraine war had been handed to Ukraine’s defense forces.” The MosgorBTI’s website has yet to comment on ...