Exploring the DNS Flipside of SideWinder

The SideWinder advanced persistent threat (APT) group, active since 2012 and known for targeting government, military, and business entities throughout Asia, primarily Pakistan, China, Nepal, and Afghanistan,¹ changed gears. They not only updated their toolset and created new infrastructure but also significantly increased attacks against maritime and logistics companies notably in Djibouti and Egypt and nuclear power plants in South Asia and Africa.

Researchers identified 35 domains as indicators of compromise (IoCs),² which we expanded to find more connected artifacts. We uncovered:

• 35 email-connected domains
• Two IP addresses, one of which turned out to be malicious
• 10 IP-connected domains
• 532 string-connected domains, 16 of which have already figured in cyber attacks

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://attack.mitre.org/groups/G0121/
• [2] https://securelist.com/sidewinder-apt-updates-its-toolset-and-targets-nuclear-sector/115847/